# this might be the most unhinged bug of the year Source: https://www.youtube.com/watch?v=HL8YZwjZHFE Recap page: https://rapidrecap.app/video/HL8YZwjZHFE Generated: 2025-07-25T15:33:06.396+00:00 --- ## Quick Overview The video demonstrates how to exploit a "ToolShell" vulnerability in Microsoft SharePoint via a "ToolPane" vulnerability, allowing for remote code execution by bypassing authentication and using a serialized data blob. **Key Points:** - A "ToolShell" vulnerability in Microsoft SharePoint allows for unauthenticated Remote Code Execution (RCE). - The exploit involves bypassing authentication using a "ToolPane" vulnerability and a serialized data blob. - Metasploit framework on Kali Linux is used to demonstrate the exploit, successfully gaining a Meterpreter session. - The attacker can execute arbitrary code, such as launching "calc.exe," on the compromised server. - The exploit relies on manipulating the "Referer" header and a base64/gzip compressed data blob. - The presenter highlights the broader risks associated with deserialization in .NET applications, particularly "BinaryFormatter." - The demonstration shows the successful migration of the Meterpreter process to a different PID for increased stealth. ![Screenshot at 00:23: Screenshot of an Ars Technica article titled "What to know about ToolShell, the SharePoint threat under mass exploitation," highlighting the vulnerability being discussed.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-23.png) **Context:** This video delves into a specific cybersecurity vulnerability found in Microsoft SharePoint, known as "ToolShell." The presenter, a cybersecurity enthusiast, demonstrates how this vulnerability can be exploited to gain unauthorized remote access to a SharePoint server. ## Detailed Analysis The video details a critical vulnerability in Microsoft SharePoint related to "ToolShell" and "ToolPane." The "ToolShell" vulnerability allows for "unauthenticated RCE" (Remote Code Execution) by bypassing authentication and exploiting a deserialization vulnerability. The presenter explains that the exploit involves sending a POST request to a "ToolPane.aspx" page with specific parameters, including a "Referer" header that points to a "SignOut.aspx" page. This exploit leverages a "serialized data blob," which is base64 and gzip compressed. The presenter demonstrates the exploit using Metasploit on a Kali Linux system targeting a SharePoint server. The process involves setting up the exploit module, specifying the target host and port, and then executing the exploit, which results in a Meterpreter session. The presenter also touches upon other potential exploits and the general insecurity of deserialization in .NET applications, specifically mentioning "BinaryFormatter." The video shows how to use Metasploit to gain control of a vulnerable SharePoint server, allowing for arbitrary code execution. ### Vulnerability Overview - ToolShell and ToolPane vulnerabilities in Microsoft SharePoint allow unauthenticated RCE ### Exploit Mechanism - POST request to ToolPane.aspx with Referer header, serialized data blob, base64/gzip compression ### Tooling Used - Metasploit framework on Kali Linux ### Demonstration - Gaining Meterpreter session on a SharePoint server, executing calc.exe ### Exploit Details - Migrating Meterpreter process to a different PID for persistence, setting payload options (reverse TCP) ### Broader Context - Insecurity of deserialization in .NET, specifically BinaryFormatter ![Screenshot at 00:01: Presenter explaining the "ToolShell" vulnerability in SharePoint.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-01.png) ![Screenshot at 00:06: Screenshot of the "National Nuclear Security Administration" website, likely for illustrative purposes.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-06.png) ![Screenshot at 00:08: Image of a missile silo opening, symbolizing a security breach or exploit.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-08.png) ![Screenshot at 00:23: Screenshot of an Ars Technica article titled "What to know about ToolShell, the SharePoint threat under mass exploitation."](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-23.png) ![Screenshot at 00:29: Screenshot of a GitHub README file showing a "curl" command with exploit details.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-29.png) ![Screenshot at 00:35: Screenshot of a SharePoint developer site with the text "Send help we have lost our sanity."](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-00-35.png) ![Screenshot at 01:13: Screenshot of a GitHub README file detailing the "curl" command and its components.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-01-13.png) ![Screenshot at 01:24: Close-up on the "curl" command, highlighting the target URL and "DisplayMode=Edit."](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-01-24.png) ![Screenshot at 01:31: The "curl" command being executed, showing its structure.](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-01-31.png) ![Screenshot at 02:01: Explanation of how the "Referer" header is used to bypass authentication on the "SignOut.aspx" page in SharePoint websites.", "02:41:Screenshot of a Microsoft Learn article discussing "Deserialization risks in use of BinaryFormatter and related.", "03:39:Warning message from Microsoft Learn stating "The pickle module is not secure. Only unpickle data you trust.", "04:41:Screenshot of a Microsoft Learn article discussing BinaryFormatter security risks.", "05:22:Kali Linux login screen showing an "Incorrect password" error, followed by the presenter's attempt to fix it.", "06:41:Screenshot of a Metasploit exploit module code for "Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution.", "07:00:Metasploit console showing the process of setting the payload for the exploit.", "07:26:List of available payloads in Metasploit for the SharePoint exploit.", "08:07:Metasploit output showing a successful Meterpreter session established.", "08:37:Calculator application launched on the target Windows machine via the Meterpreter session.", "09:16:The deserialized data blob used in the exploit, appearing as a long string of characters.", "10:03:Presenter expressing frustration with the complexity of configuring Windows servers for exploits."](https://ss.rapidrecap.app/screens/HL8YZwjZHFE/00-02-01.png)