Sharepoint Document Extractor

[Vikramvermahsoft]

This module enumerates and extracts documents from a specified SharePoint library using the SharePoint .NET API. Designed to run in an existing Windows session (e.g., Meterpreter or shell) on a SharePoint server, it supports two exfiltration methods—HTTP (to an attacker-controlled server) or Meterpreter (via base64-encoded output stored as loot). It includes configurable options for the target site URL, library name, exfiltration method, and maximum file size, along with robust error handling for library access and file processing. This tool is ideal for penetration testers targeting enterprise environments where SharePoint stores sensitive documents, such as in DoD or corporate networks.

Functionality
Queries the SharePoint API to list and retrieve documents from a specified library.
Filters files by size to avoid memory issues or detection.
Exfiltrates documents via HTTP POST or Meterpreter, saving them as loot with metadata.
Provides detailed status output (e.g., successes, skips, errors) for user feedback.
Tested On
Windows Server 2016 with SharePoint Server 2016
Meterpreter session generated via windows/meterpreter/reverse_tcp
Successfully extracted multiple test files (PDFs, DOCX) under 10MB from the "Documents" library
Verified compatibility with HTTP exfiltration to a Python http.server listener
References
SharePoint .NET API Documentation
Inspired by general SharePoint security research; no direct CVE dependency
Checklist
Tested locally in msfconsole with reload_all and successful execution
Passes tools/dev/msftidy.rb with no errors or warnings (fixed superclass, removed redundant require, corrected check codes, converted to Unix EOLs)
Passes bundle exec rubocop with no offenses (added Notes section per guidelines)
Includes comprehensive metadata (Name, Description, Author, Notes, etc.)
No malicious code; designed for ethical penetration testing use only
Notes
Stability: STABILITY_CRASH_SAFE—uses native SharePoint APIs, unlikely to crash the server.
Reliability: RELIABILITY_REPEATABLE_SESSION—consistent results given proper permissions and SharePoint access.
Side Effects: SIDE_EFFECTS_NETWORK_TRAFFIC—HTTP exfiltration generates network activity; Meterpreter mode is cleaner.

[github-actions]

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

• Writing Module Documentation
• Template
• Examples

[smcintyre-r7]

The formatting from about here until the document ends is not exactly well-structured markdown.

The document should follow our standard template. There's an msftidy_docs.rb file that should also be run on the docs page to identify common issues. You should also be careful to note that different markdown rendering engines will show things slightly differently. We should ensure that the one used by Metasploit when msfconsole's info -d command is run will display the content correctly.