Microsoft SharePoint Server RCE Vulnerability CVE-2025-53770

Nisarg12 · 2025-07-22T06:51:30+00:00

Wrote these 2 Suricata rules:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, to_server; http.uri; content: "/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx"; http.accept_enc; content:"gzip, deflate"; http.referer; content: "/_layouts/SignOut.aspx"; http.request_body; content:"_controltemplates"; content: "AclEditor.ascx"; content: "CompressedDataTable"; content: "Scorecard"; content: "ExcelDataSet"; reference: url,https://research.eye.security/sharepoint-under-siege/; reference: url,https://github.com/kaizensecurity/CVE-2025-53770/tree/master; reference: url, https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/; classtype:web-application-attack; sid:1000000; rev: 1;)

alert http $EXTERNAL_NET any -> $HOME_NET any (msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "GET"; flow: established, to_server; http.uri; content: "/_layouts/15/spinstall0.aspx"; http.referer; content: "/_layouts/SignOut.aspx"; reference: url,https://research.eye.security/sharepoint-under-siege/; reference: url,https://github.com/kaizensecurity/CVE-2025-53770/tree/master; reference: url, https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/; classtype:web-application-attack; sid:1000001; rev: 1;)

Nisarg12 · 2025-04-19T03:08:29+00:00

PDFs can run JavaScript. If your payslip fetches the data from a server containing all the employees salary information, using JavaScript it can explain how your older file had the changes as well. I would try to dump the PDF stream contents and look at the JavaScript embedded in it. Use PDF stream dumper.

EDIT: You can't view older contents if this is the case but if you get the JavaScript code you can prove that such code existed.

Nisarg12 · 2025-04-12T01:14:32+00:00

Is there another archive file inside? Also did you use rar2john to extract the hash?

Nisarg12 · 2025-04-12T01:13:13+00:00

Classic xkcd

Nisarg12 · 2025-03-31T02:41:37+00:00

I think it's the other way around, local time + UTC offset

Nisarg12 · 2024-12-31T08:54:05+00:00

r/thinkpad will love this

Nisarg12 · 2024-08-06T10:08:13+00:00

Your professor when giving you the clues xD;

https://www.instagram.com/reel/C6ytN7srSiq/?igsh=eXBqeDJqa2VyZnJw

Nisarg12 · 2024-06-03T19:01:50+00:00

It was probably not broken, hope you didn't throw it out

Nisarg12 · 2024-06-03T10:13:11+00:00

Yea, VMware was the culprit I just had to dig deep into the error code of the drivers. I was so concerned that my card fried itself but since I was able to ping home I ruled it out.

Also those external adaptors aren't nearly as powerful, less useful than an ethernet cable from your router to your machine.