Payloads and black-box scanning about ysoserial.net HOT 4 CLOSED

In which scenario would (Gadget: ObjectDataProvider, Formatter: Json.net) work, and (Gadget: WindowsIdentity, Formatter: Json.net) not?

The only case I can think of is that the applcation is blacklisting one but not the other, but I would bet that those blacklists will contain all gadgets in ysoserial. So in practice, using one of them would be enough. ObjectDataProvider is easier since it does not involve BinaryFormatter, but in the other hand you can choose WindowIdentity and a BinaryFormatter payload using the ActivitySurrogateSelector to run arbitrary c# code (eg: DNS lookup for out-of-band detection, sleep, etc)

In general I would use ActivitySurrogateSelector gadget for the reasons explained above when there are different gadgets that work for a formatter.

In my experience, automizing the exploitation of Json.Net, XmlSerializer, LosFormatter, ObjectStateFormatter, DataContractSerializer is very difficult, so I would only try sending payloads for BinaryFormatter, FastJson and JavaScriptSerializer. The first group require finding the right injection point, controlling the expected type, etc.

Also ObjectStateFormatter and LosFormatter are only used for ASP.NET ViewState, and you can only exploit it if it is not signed or you can leak the encryption and validation keys from Web.config (and infer some other parameters). I have a small tool to generate a ViewState payload if you know the key. I will integrate it into ysoserial.

I'm sending the payloads to all parameters, sending them as-is and base64 encoded, sending them in query string, post-data, cookies.

I think it would be better to send it if you find a parameter, input field, cookie, etc already using it. So using passive approach for detection and active one for verification

Hope it helps,
A

from ysoserial.net.

@pwntester thanks for the very detailed answer. So, based on your recommendations it seems that I'll send the following gadgets / formatters:

• ActivitySurrogateSelector, BinaryFormatter
• ObjectDataProvider, FastJson
• ObjectDataProvider, JavaScriptSerializer

For the ActivitySurrogateSelector I'll code a short ExploitClass that will sleep() in order to perform detection. The other ones I believe I'll use the ping localhost -n X command in order to introduce the time delay I need.

The w3af plugin is almost ready, I just need to add these payloads and test :-) Do you know of a test web application I can use for testing the payloads I generate? (I know about -t but a web would allow me to better test this).

from ysoserial.net.

PS: I implemented some logic for deciding when to inject the payloads. The code can be found here and here. The logic is not perfect (lots of false positives: w3af will inject even when the original parameter value was not a serialized object), but at least it will not inject into everything.

from ysoserial.net.

@andresriancho sorry, forgot about this issue. Is this anything else I can help you with?

from ysoserial.net.