CVE-2025-53770 - Scanner for the SharePoint CVE-2025-53770 RCE zero

项目说明

C

This is a scanner for the SharePoint unauthenticated Remote Code Execution , assigned C C.
The code for this was written by re a payload seen in the wild.

Use at your own risk, I am not responsible for any negati this might cause.

How does it work?

It tries to exploit the by injecting a marker in the SharePoint ToolBox widget.
If in the SharePoint ser this unharmful marker is found, the host is marked as .

How to use

Who is ?

Anyone running the *on-prem* of SharePoint ser KB5002768 & KB5002754.

How does this work?

The presumably builds upon a pre disclosed for SharePoint, C.
By sending a HTTP POST request to with a GZIP-ed, BASE64-encoded payload, you can achie Code Execution as the SharePoint runtime process.
Two form parameters are important here:

1. MSOTlPn_Uri: Control source path

This pretends to reference a legitimate SharePoint control (AclEditor.ascx), and tricks SharePoint into allowing the web part edit.
This seems to be mock/fake value just to pass .
The original malicious payload includes MSOTlPn_Uri=, but this does not seem to be used at this point.

2. MSOTlPn_DWP: Web partial configuration.

This parameter injects custom ASP.NET directives (<%@ Register %>) and ser markup (<Scorecard:ExcelDataSet>).
The CompressedDataTable parameter holds attacker-controlled serialized data (GZIP + base64), triggering the RCE.
This payload follows a certain structure:

If a control like Scorecard:ExcelDataSet exists and its CompressedDataTable property is set, it's deserialized directly by the SharePoint DWP Parser.

The payload itself can be rather interesting, as it can contain a System.DelegateSerializationHolder which triggers a deserialization RCE.
Threat actors abused this to pass /c powershell -EncodedCommand <POWERSHELL-PAYLOAD> in their payload to achieve code exection.
In our case, we merely pass a static placeholder to pro;

项目信息

开发语言：Go

Star 数：45

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。