CVE-2025-53770 PoC — Microsoft SharePoint Server Remote Code Execution Vulnerability

Source

Associated Vulnerability

Readme

# Pre-Exploit Vulnerability Check for CVE-2025-53770 (with Burp Suite Proxy)

This script checks a list of SharePoint hosts for vulnerability to CVE-2025-53770 using a custom payload and routes all requests through Burp Suite's proxy for interception and analysis.

## Features
- Checks single or multiple targets for CVE-2025-53770.
- Uses a custom payload (from a JSON file).
- Sends requests through Burp Suite proxy (`http://127.0.0.1:8080`).
- Suppresses SSL warnings for clean output.
- Saves all vulnerable hosts to `vulnerable_hosts.txt` after the scan.
- Prints `[VULNERABLE]`, `[SAFE]`, or `[ERROR]` for each target.

## Requirements
- Python 3.7+
- `requests` library (`pip install requests`)
- Burp Suite (optional, for interception)
- `config.json` (scanner config)
- `payload.json` (POST data for the exploit)
- Target list file (e.g., `live_list.txt`)

## Usage

### 1. Prepare Files
- `config.json`: Contains detection rules, endpoints, headers, etc.
- `payload.json`: Contains only the POST data, e.g.:
  ```json
  {
    "MSOTlPn_Uri": "https://{host}/_controltemplates/15/AclEditor.ascx",
    "MSOTlPn_DWP": "<your payload here>"
  }
  ```
- `live_list.txt`: List of targets (one per line, IP or hostname only, no protocol).

### 2. Start Burp Suite (Optional)
- Open Burp Suite and ensure the proxy is listening on `127.0.0.1:8080`.

### 3. Run the Script

**For a list of targets:**
```bash
python3 Vul_Sacnner.py -l live_list.txt --payload payload.json
```

**For a single target:**
```bash
python3 Vul_Sacnner.py -t 1.2.3.4 --payload payload.json
```

After the scan, check `vulnerable_hosts.txt` for the list of vulnerable hosts.

File Snapshot

 [4.0K]  /data/pocs/db5a2c5029ef5ea814a212bef8fce9241ed46805
├── [4.6K]  config.json
├── [ 896]  payload.json
├── [1.6K]  README.md
└── [6.3K]  Vul_Sacnner.py

0 directories, 4 files

Remarks