↓ Skip to main content
bubka hacks stuff

SharePoint

LD-CVE-2025-53770 SharePoint ToolShell Auth Bypass and RCE

SOC SIEM EDR Log Analysis Web Attack RCE CVE-2025-53770 SharePoint Escalation to L2 True Positive AbuseIPDB VirusTotal
An attacker exploited CVE-2025-53770 against a SharePoint server, achieving unauthenticated RCE via .NET deserialization. The attacker extracted the MachineKey, compiled and dropped a payload, planted a webshell in the SharePoint layouts directory, and established a reverse connection to the attacker-controlled server.