Microsoft SharePoint Application Package Remote Code Execution

This repository contains a Python exploit script (cve-2019-0604-exp.py) targeting Microsoft SharePoint servers vulnerable to CVE-2019-0604, a remote code execution flaw. The exploit works by sending crafted requests to the SharePoint Picker.aspx endpoint, leveraging the vulnerability to upload a web shell (ua.aspx) to the server. Once the shell is uploaded, the script attempts to access it to verify successful exploitation. The main file is a standalone Python script, and the only other file is a README with references to further documentation. The exploit requires the attacker to provide the base URL of the target SharePoint instance. The script is operational and provides a working web shell if the target is vulnerable.

This repository is a proof-of-concept exploit for CVE-2019-0604, a remote code execution vulnerability in Microsoft SharePoint. The main code is in 'ConsoleApplication1/ConsoleApplication1/Program.cs', a C# console application that demonstrates how a malicious XAML file (t.xml) can be used to trigger code execution via SharePoint's deserialization of XAML. The exploit leverages the 'ObjectDataProvider' in XAML to launch arbitrary commands (e.g., 'cmd.exe /c calc'). The repository includes the XAML payload (t.xml) and the C# code that loads and executes it, simulating the vulnerable SharePoint behavior. No network endpoints or hardcoded IPs are present, but the attack vector is network-based, targeting SharePoint servers that process attacker-supplied XAML. The exploit is a POC and does not include weaponized or automated exploitation scripts.

This repository is a weaponized exploit for CVE-2019-0604, a critical remote code execution vulnerability in Microsoft SharePoint. The main exploit logic is in 'exploit.py', which automates the exploitation process, supporting both direct command execution and file upload (such as webshells) to the target SharePoint server. The exploit can operate in both authenticated and unauthenticated modes, depending on the target's configuration. It supports out-of-band (OOB) exfiltration of command output via DNS or HTTP channels, integrating with services like Burp Collaborator or requestbin.net. The payloads are serialized XAML objects that trigger the vulnerability, and the repository includes helper scripts for request parsing, payload generation, and OOB data handling. The structure is modular, with separate files for SharePoint-specific payload crafting ('sharepointkit.py'), OOB handling ('oob/collab_handler.py', 'oob/decoder.py'), and a sample PowerShell webshell ('oob/payload.ps1'). The exploit is operational and can be used to gain remote code execution, upload arbitrary files, and retrieve output from the target system.