SpellBook

Mon, 01 Jan 0001 00:00:00 +0000

Setup#

Install Visual Studio. If you already have, open Visual Studio Installer -> Modify And install .NET desktop development We can create a new Console App (.NET Framework) project for all the exploit developments here

.NET Deserialization gadgets#

Before exploiting any .NET deserialization vulnerabilities, we need to know about the gadgets that we can use to invoke a method (function) that we want. We will walk through 2 gadget chains that results in RCE. The reason we need these gadgets is because we cannot directly invoke a method via deserialization. Creating an object is not the same as running a function. However, there are some workaround that we can use to invoke a method without directly do so.

Mon, 01 Jan 0001 00:00:00 +0000

Example 1 - PHP#

We found a webapp with a export settings import settings function. When we try exporting our settings, we got this string:

TzoyNDoiQXBwXEhlbHBlcnNcVXNlclNldHRpbmdzIjo0OntzOjMwOiIAQXBwXEhlbHBlcnNcVXNlclNldHRpbmdzAE5hbWUiO3M6NzoicGVudGVzdCI7czozMToiAEFwcFxIZWxwZXJzXFVzZXJTZXR0aW5ncwBFbWFpbCI7czoyMzoicGVudGVzdEBwZW50ZXN0LnBlbnRlc3QiO3M6MzQ6IgBBcHBcSGVscGVyc1xVc2VyU2V0dGluZ3MAUGFzc3dvcmQiO3M6NjA6IiQyeSQxMCROdjAyRWppUjNheDcwMFJNZUFtd2oua2JUOVNQaGNJMjhJT0dKN2ZadTIwL0pYNlhGZTRNYSI7czozNjoiAEFwcFxIZWxwZXJzXFVzZXJTZXR0aW5ncwBQcm9maWxlUGljIjtzOjExOiJkZWZhdWx0LmpwZyI7fQ==

We try to base64 decode it, and got this string. It looks like a php serialized data.

$ echo 'TzoyNDoiQXBwXEhlbHBlcnNcVXNlclNldHRpbmdzIjo0OntzOjMwOiIAQXBwXEhlbHBlcnNcVXNlclNldHRpbmdzAE5hbWUiO3M6NzoicGVudGVzdCI7czozMToiAEFwcFxIZWxwZXJzXFVzZXJTZXR0aW5ncwBFbWFpbCI7czoyMzoicGVudGVzdEBwZW50ZXN0LnBlbnRlc3QiO3M6MzQ6IgBBcHBcSGVscGVyc1xVc2VyU2V0dGluZ3MAUGFzc3dvcmQiO3M6NjA6IiQyeSQxMCROdjAyRWppUjNheDcwMFJNZUFtd2oua2JUOVNQaGNJMjhJT0dKN2ZadTIwL0pYNlhGZTRNYSI7czozNjoiAEFwcFxIZWxwZXJzXFVzZXJTZXR0aW5ncwBQcm9maWxlUGljIjtzOjExOiJkZWZhdWx0LmpwZyI7fQ==' | base64 -d

O:24:"App\Helpers\UserSettings":5:{s:30:"App\Helpers\UserSettingsName";s:7:"pentest";s:31:"App\Helpers\UserSettingsEmail";s:23:"pentest@pentest.pentest";s:30:"App\Helpers\UserSettingsRole";s:4:"user";s:34:"App\Helpers\UserSettingsPassword";s:60:"$2y$10$Nv02EjiR3ax700RMeAmwj.kbT9SPhcI28IOGJ7fZu20/JX6XFe4Ma";s:36:"App\Helpers\UserSettingsProfilePic";s:11:"default.jpg";}

Source analysis#

When we see the source code for the handleSettingsIE function, we can see that it deserialize user input base64 data into userSettings object without sanitizing/filtering

Mon, 01 Jan 0001 00:00:00 +0000

Python#

When we login to this webapp, we got a cookie like this:

HTTP/1.1 302 Found
Set-Cookie: auth_8bH3mjF6n9=gASVSgAAAAAAAACMCXV0aWwuYXV0aJSMB1Nlc3Npb26Uk5QpgZR9lCiMCHVzZXJuYW1llIwNZnJhbnoubXVlbGxlcpSMBHJvbGWUjAR1c2VylHViLg==

We try to base64 decode the cookie and it starts with the bytes 80 04 95 and ends with a period. Compare it to our cheatsheet at #Black-Box, this is python Pickle version 4 serialized object.

$ echo gASVSgAAAAAAAACMCXV0aWwuYXV0aJSMB1Nlc3Npb26Uk5QpgZR9lCiMCHVzZXJuYW1llIwNZnJhbnoubXVlbGxlcpSMBHJvbGWUjAR1c2VylHViLg== | base64 -d | xxd

00000000: 8004 954a 0000 0000 0000 008c 0975 7469  ...J.........uti
00000010: 6c2e 6175 7468 948c 0753 6573 7369 6f6e  l.auth...Session
00000020: 9493 9429 8194 7d94 288c 0875 7365 726e  ...)..}.(..usern
00000030: 616d 6594 8c0d 6672 616e 7a2e 6d75 656c  ame...franz.muel
00000040: 6c65 7294 8c04 726f 6c65 948c 0475 7365  ler...role...use
00000050: 7294 7562 2e                             r.ub.

Source Analysis#

This is the /login path in app.py. After we log in: