LetsDefend — SOC342 — CVE-2025–53770

Before the start Investigation i need to learn what is the CVE-2025–53770 attack

What is SharePoint?

• Microsoft’s enterprise file-sharing and collaboration platform

Step by Step what happening?

Attacker sends HTTP POST request to SharePoint’s ToolPane.aspx page without authentication. Request features: Fake referer header settings up /layouts/SignOut.aspx to look legitimate, There is a large payload of 7699 bytes and no authentication headers at all

Imagine this story:

• A building security guard checks every employee’s ID card. But the attacker wears a fake badge and walks through sayin: I was just leave and the security believes him.

Alert:

Before the start with playbook i need to look at the gave our information.

Hostname : SharePoint01

Source IP Address : 107.191.58.76

Destination IP Address : 172.16.20.17

HTTP Request Method : POST

Requested URL : /_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx

User-Agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0

Content-Length : 7699

1- Understand Wht the Alert Was Triggered?

SharePoint — Target system Enterprise Microsoft Platform.

ToolShell — The name of the attack Over the ToolPange.aspx uploaded shell.

Auth Bypass — Authentication bypassed, saldırgan entered the system without password with fake referer header.

RCE — Remote Code Execution,

Source IP: 107.191.58.76

Destination IP: 172.16.20.17

Hostname: SharePoint01

2- Collect Data

Ownership of the IP addresses and devices.

SharePoint01–172.16.20.17

If the traffic is coming from outside (Internet); YES

• Ownership of IP address (Static or Pool Address? Who owns it? Is it web hosting?)

This IP address based in the US, Los Angeles, ISP is Vultr Holdings. Usage Type is: Data Center / Web Hosting / Transit

If we look at the community comments:

Many Cyber Security Analyst reported them. This IP address is malicious we sure it.

• Reputation of IP Address (Search in VirusTotal, AbuseIPDB, Cisco Talos)

If we look in the VirusTotal people reported it here too

If the traffic is coming from company network;

This traffic is network traffic coming from outside to inside therfore my answer is NO.

3- Examine HTTP Traffic.

To deeply examine http traffic i need to look at the Log Management page. I filtered by source IP address: 107.191.58.76.

Appears one event. This is HTTP request in the Alert that we are getting as suspicious.

Attacker sent POST request in ToolPane.aspx and with DisplayMode=Edit tried to open edit mode.

Payload is so high: 7699 A normal ToolPane request wouldnt be this large

Referer: SignOut.aspx this section is to auth bypass. Attacker says “I was coming out”. SharePoint believed it and confirm this request.

4- Is Traffic Malicious?

We investigated Source IP, Request URL, Headers and we can say that is traffic Malicious.

Based on OSINT data and our analysis of company network traffics we can determine that is incoming HTTP POST request is malicious.

5- What Is The Attack Type?

I selected Other because this attack is Deserialization + Auth Bypass + Remote Code Execution.

6- Check If It Is a Planned Test

I searched on the Emails with “SharePoint1” and “107.191.58.76” keywords bu i cant find any email. Therefore i select Not Planned. Already the ip address that sent the request is considered a real suspect. Therefore this is not pentest.

7- What Is the Direction of Traffic?

107.191.58.76 → 172.16.20.17.

Internet → Company Network

8- Check Whether the Attack Was Successful

Going to Endpoint Security Page:

we need to sure about this events when happened Because of this I need to check event ID in monitoring tab These have events happened 13: 07 PM In the endpoint security tab I entered the Sharepoint01 endpoints and then I will check the What happened after this sent it from the attacker.

in the Processes tab I need to look what’s happened what executed What process running after this request sent from attacker. At the 13.7 An w3wp.exe executed. This is IIS Worker Process, runs in the web servers. This was triggered sent HTTP Request

Process Command Line: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\bin\w3wp.exe

After this .exe file executed an powershell command executed by the .exe file that was just executed w3wp.exe

Some text sent over encoded text i can understand this.

And i decode this encrpyted data with CyberChef.

This ASP.NET script using for the Credential Access or Discovery. After this script sent over encrypted text.

After then, csc.exe C# Compiler ran. Attacker compiled this ASP.NET script with this. Now attacker can execute any command on the server by sending an HTTP request here.

csc.exe /out:C:\Windows\Temp\payload.exe C:\Windows\Temp\payload.cs

spinstall0.aspx→ Web Shell

The attacker can execute any command they wish on the server by sending an HTTP request here.

Then, Attacker compiles ASP.NET script with csc.exe to .aspx file. Sends commands to perform Discovery.

dir, Get-Process, Task manager

9- Was the Attack Successful?

Yes.

10- Containment

I containmented this host.

11- Add Artifacts

12- Analyst Note

Efe Ozel — SOC Analyst