SharePoint
plugin
Generates payloads for the following SharePoint CVEs: CVE-2026-50522, CVE-2025-53770, CVE-2025-49704, CVE-2024-38018, CVE-2020-1147, CVE-2019-0604, CVE-2018-8421
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -p SharePoint -hTarget declarations
Runtime tokens: unspecified.
Structured formatter and requirement metadata is not declared. Read the description and option help for conditions.
Options (13)
| Option | Help | Default | Required |
|---|---|---|---|
cve= | the CVE reference: CVE-2026-50522, CVE-2025-53770, CVE-2025-49704, CVE-2024-38018, CVE-2020-1147, CVE-2019-0604, CVE-2018-8421 Suggested values: CVE-2026-50522, CVE-2025-53770, CVE-2025-49704, CVE-2024-38018, CVE-2020-1147, CVE-2019-0604, CVE-2018-8421. Required. | Not declared | true |
useurl | to use the XAML url rather than using the direct command in CVE-2019-0604 and CVE-2018-8421 Default value: "false". | false | false |
g|gadget= | a gadget chain for CVE-2020-1147 (LosFormatter) or CVE-2024-38018 / CVE-2026-50522 (BinaryFormatter). Default: TypeConfuseDelegate Values: see --list gadgets. | TypeConfuseDelegate | false |
c|command= | the command to be executed e.g. "cmd /c calc" or the XAML url e.g. "http://example.local/x" to make the payload shorter with the `--useurl` argument Required. | Not declared | true |
target= | for CVE-2026-50522: the absolute SharePoint base URL used as the wctx value. Required with --formbody; on the default token output it only fills the delivery comment's wctx example. It is NOT contacted. | Not declared | false |
formbody | CVE-2026-50522 only: emit the full URL-encoded wa/wctx/wresult form body ready to POST, instead of just the wresult token. Requires --target. Default value: "false". | false | false |
minify | Whether to minify the payloads where applicable (experimental). Applies to the BinaryFormatter/LosFormatter gadget CVEs. Default: false | false | false |
ust|usesimpletype | This is to remove additional info only when minifying and FormatterAssemblyStyle=Simple. Default: true | true | false |
rawcmd | Command will be executed as is without `cmd /c ` being appended (anything after the first space is an argument). Default value: "false". | false | false |
no-comment | Output only the serialized payload or form body, without the trailing explanatory HTML comment. Default value: "false". | false | false |
var|variant= | Variant number for CVE-2025-49704 only. Choices: 1 (default, uses DataSetOldBehaviourGenerator variant 2), 2 (uses DataSetOldBehaviourFromFileGenerator variant 2) Default value: "1". Suggested values: 1, 2. | 1 | false |
spver= | CVE-2024-38018 only: which SharePoint generation to target. Choices: 2019 (default), 2016, 2013. 2016 and 2019 share the same assembly identity and produce the same payload; 2013 uses LosFormatter and the 15.0.0.0 assembly reference. Default value: "2019". Suggested values: 2019, 2016, 2013. | 2019 | false |
i-understand-dos | Acknowledge that a denial-of-service gadget can disrupt or terminate the target process. It is required to generate one and is not needed by any other gadget. Default value: "false". | false | false |
Mode declarations
[
{
"name": "CVE-2025-49704 (ToolShell)",
"description": "ToolPane.aspx DataSet gadget; pick a variant.",
"options": [
"command",
"rawcmd",
"variant",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2025-49704"
}
},
{
"name": "CVE-2025-53770 (ToolShell patch bypass)",
"description": "CVE-2025-49704 with the patch bypass; pick a variant.",
"options": [
"command",
"rawcmd",
"variant",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2025-53770"
}
},
{
"name": "CVE-2024-38018",
"description": "SPObjectStateFormatter webpart; choose a BinaryFormatter gadget and the SharePoint generation.",
"options": [
"command",
"rawcmd",
"gadget",
"spver",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2024-38018"
}
},
{
"name": "CVE-2020-1147",
"description": "DataSet quicklinks gadget; choose a LosFormatter gadget.",
"options": [
"command",
"rawcmd",
"gadget",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2020-1147"
}
},
{
"name": "CVE-2019-0604",
"description": "XmlSerializer workflow; command or a XAML url (--useurl).",
"options": [
"command",
"rawcmd",
"useurl",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2019-0604"
}
},
{
"name": "CVE-2018-8421",
"description": "Workflow markup; command or a XAML url (--useurl).",
"options": [
"command",
"rawcmd",
"useurl",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2018-8421"
}
},
{
"name": "CVE-2026-50522",
"description": "Pre-auth SharePoint WS-Federation trust endpoint; deflate-only token, no DPAPI/MachineKey secret needed. Default output is the wresult token; enable formbody for the full POST body (needs target).",
"options": [
"command",
"rawcmd",
"target",
"gadget",
"formbody",
"minify",
"usesimpletype",
"no-comment"
],
"requiredOptions": [
"command"
],
"preset": {
"cve": "CVE-2026-50522"
}
}
]Credit: CVE-2024-38018: Piotr Bazydło - explained by Khoa Dinh & implemented by Soroush Dalili, CVE-2025-49704: Khoa Dinh - implemented by Soroush Dalili, CVE-2025-53770: patch bypass of CVE-2025-49704 - implemented by Soroush Dalili, CVE-2026-50522: splitline of DEVCORE Research Team (ZDI-26-412) - implemented by Soroush Dalili, CVE-2018-8421: Soroush Dalili, CVE-2019-0604: Markus Wulftange, CVE-2020-1147: Oleksandr Mirosh, Markus Wulftange, Jonathan Birch, Steven Seeley (write-up) - implemented by Soroush Dalili