Unauthenticated RCE in Microsoft SharePoint Server via Deserialization

Repository contains a documented proof-of-concept and detection notes for SharePoint /_trust WS-Federation SecurityContextToken deserialization leading to unauthenticated RCE and machine-key theft. Structure is small and focused: README and index.html provide the writeup; detection/hunting.md contains defender-oriented hunting guidance; artifacts/ contains redacted example telemetry; scripts/ contains the actual exploit code. The main exploit capability is in scripts/cve-2026-58644_oob_param.ps1. It is a parameterized PowerShell exploit that builds a PowerShell payload, base64-encodes it for -EncodedCommand, invokes ysoserial.net to generate a BinaryFormatter gadget (default TypeConfuseDelegate), wraps the raw gadget bytes with System.IdentityModel.DeflateCookieTransform, embeds that into a crafted WS-Federation RequestSecurityTokenResponse, and POSTs it to $Target/_trust/default.aspx with wa=wsignin1.0. Capabilities include arbitrary command execution, optional HTTP callback/beaconing, optional file drop, optional diagnostic exfiltration, proxy support, and optional direct powershell execution via --rawcmd to avoid cmd.exe in the process tree. The second exploit, scripts/cve-2026-58664_machinekeys.ps1, is a two-stage PowerShell exploit for in-process machine-key disclosure. It generates two ysoserial payloads: a preamble using ActivitySurrogateDisableTypeCheck and a main payload using ActivitySurrogateSelectorFromFile to compile embedded C# code (KeyDump) inside w3wp.exe. That C# reflects into System.Web.Configuration.MachineKeySection, extracts ValidationKey/DecryptionKey and related settings, clears the HTTP response, and writes the values back between sentinel markers. This is more stealthy than the OOB RCE path because it avoids child process creation and external beaconing. Overall, this is a real exploit repository rather than a detector-only repo. It is not part of a major exploitation framework. The code is operational but still PoC-style: payloads are customizable through parameters, but execution depends on an external ysoserial.net binary and a vulnerable SharePoint deployment. The most fingerprintable target artifact across both scripts is POST traffic to /_trust/default.aspx carrying wa=wsignin1.0 and a RequestSecurityTokenResponse/SecurityContextToken body.

Repository documents and preserves observed exploitation artifacts for Microsoft SharePoint CVE-2026-50522 rather than providing a standalone exploit script. Structure consists of a README summarizing multiple exploit attempts, eight raw HTTP request captures under http/, and two ASPX webshells under webshells/. The HTTP captures show crafted POST requests to SharePoint trust/authentication endpoints using wa=wsignin1.0 with attacker-controlled wctx and large wresult token blobs containing SecurityContext identifiers, consistent with remote web exploitation of SharePoint authentication/trust handling. README correlates these requests with payload DLL names, hashes, timestamps, source IPs, and notes on behavior. The main offensive capability is post-exploitation on SharePoint: several DLL payloads are described as returning MachineKeys, enabling theft of ASP.NET cryptographic material; others support upload or write a persistent ASPX backdoor. The included webshells confirm intended outcomes. layout2sp.aspx is a compact credential-material disclosure shell that loads System.Web and invokes the non-public MachineKeySection.GetApplicationConfig method, then prints ValidationKey, Validation algorithm, DecryptionKey, Decryption algorithm, and CompatibilityMode. cmRANDOM.aspx is a more feature-rich operator panel titled "Helper Tool" that supports file upload to arbitrary paths, retrieval of MachineKey info, and execution of attacker-supplied Base64/Gzip-wrapped .NET assemblies in memory via Assembly.Load, invoking method GetResult on class G with an optional command parameter. This provides flexible in-memory payload execution and persistence. Overall, this is a real exploit-artifact repository with operational tradecraft: initial remote exploitation via SharePoint trust/auth endpoints, follow-on machine key extraction, optional outbound staging via PowerShell, and deployment of ASPX webshells for persistence and arbitrary code execution.

This repository is a standalone Python exploit/scanner for CVE-2026-50522, described as an unauthenticated SharePoint deserialization RCE against the WS-Federation endpoint /_trust/default.aspx. The main file, CVE-2026-50522.py, accepts either a single target or a target list, generates a ysoserial.net BinaryFormatter payload with the TypeConfuseDelegate gadget, compresses and base64-encodes the serialized bytes, wraps them in a SecurityContextToken/RequestSecurityTokenResponse XML structure, and POSTs the result as the wresult parameter to the SharePoint trust endpoint. The embedded command is a PowerShell Invoke-WebRequest to an operator-supplied OOB callback URL, so the exploit confirms code execution via outbound HTTP/DNS-style beaconing rather than an interactive shell. Operationally, the script supports multithreaded mass scanning (10 threads), retries, optional HTTP proxying, disabled TLS verification, and two callback naming modes: path-based and subdomain-based. It analyzes HTTP responses for signs such as login pages, token-related content, auth cookies, redirects to auth flows, AMSI blocking text, and common error codes. Results are aggregated to distinguish potential exploitation, AMSI-interfered cases, and outright failures. Repository structure is simple: one primary Python exploit, one README, and a ysoserial helper directory. The ysoserial directory appears to contain supporting artifacts and sample C# payload sources rather than the full framework source. ExploitClass.cs contains example payload behaviors such as message boxes, file creation, DNS lookups, command execution, and payload download/execution. GhostWebShell.cs is a more advanced auxiliary payload that registers a custom ASP.NET VirtualPathProvider to expose a ghost web shell at a synthetic path ending in ghostfile.aspx. The remaining XML files are documentation/config artifacts for .NET dependencies and do not themselves implement the exploit logic. Overall, this is a real exploit-oriented mass scanner with a hardcoded, basic OOB verification payload, making it more than a detector but less flexible than a full exploitation framework.