RogueRemotingServer

A rogue .NET Remoting server to deliver BinaryFormatter/SoapFormatter payloads to connecting clients.

Usage

Usage:  RogueRemotingServer.exe [OPTIONS] URL PATH

A rogue .NET Remoting server to deliver BinaryFormatter/SoapFormatter payloads to connecting clients.

Positional arguments:
  URL       remoting URL
  PATH      path to payload file

Options:
  -f, --format=VALUE         message format (Default, Binary, Soap)
  -p, --property=VALUE1=VALUE2
                             channel properties (see http://msdn.microsof-
                               t.com/kw7c6kwc)
      --wrapSoapPayload      wrap SOAP payload in MethodResponse message
  -v, --verbose
  -h, -?, --help

Examples:
  RogueRemotingServer.exe --wrapSoapPayload http://0.0.0.0:12345/Foo path\to\raw\payload.soap
  RogueRemotingServer.exe ipc://NamedPipeName/Bar path\to\raw\payload.bin
  RogueRemotingServer.exe -p=secure=true tcp://0.0.0.0:12345/Baz path\to\raw\payload.bin

.NET Remoting clients generally expect Soap for HTTP and Binary for IPC and TCP.

Intended to deliver raw BinaryFormatter/SoapFormatter generated by YSoSerial.Net. Use --wrapSoapPayload for SoapFormatter payloads.

You can use the ObjRef gadget to cause an outgoing .NET Remoting method call to a specified URL on arbitrary BinaryFormatter/SoapFormatter deserialization.

References

• Code White blog post .NET Remoting Revisited