.NET Deserialization Library Improvements

[zeroSteiner]

This adds two new chains (TypeConfuseDelegate, WindowsIdentity) and a new formatter (SoapFormatter) to the Msf::Util::DotNetDeserialization library and updates the applicable modules to use them. The entire implementation is based on the MS-NRBF spec as implemented using bindata.

All three gadget chains were adapted from the YSoSerial.NET project. Credit for each chain is in the comments of their respective modules. Each chain was parsed using the bindata records and then recreated in Ruby using the new library. This process was roughly equivalent to the following, and can be used to add additional chains in the future. Missing record values will raise an exception indicating that they must be implemented.

stream = Msf::Util::DotNetDeserialization::Types::SerializedStream.new
stream.read(serialized_data)
stream.pretty_print(PP)

Full example

The #generate_gadget_chain method (which is not currently used by any modules) was updated to return a SerializedStream object. This change was necessary to allow the formatters to determine both the type of chain (gadget chains are SerializedStream subclasses) and inspect the contents for applicable conversion. Both #generate and #generate_formatted both still return the serialized data in a string.

I have a WIP wiki page for module authors on how to use this new library.

Testing

• The SoapFormatter will be used by PR Added exploit module kentico_staging_syncserver. #13107

• The new unit tests should pass without any errors, issues, exceptions (dot_net_deserialization_spec.rb)
• Use exploit/windows/http/ssrs_navcorrector_viewstate for testing. This module is a great use-case because all three chains work with it (still have to use the LosFormatter).
  • You can manually adjust the gadget_chain parameter since it's not exposed as a datastore option. It doesn't really make sense for this to be user controllable, but it works quite well as a test case. The LosFormatter relies on the BinaryFormatter allowing both to be tested at once.
  • Test exploit with TextFormattingRunProperties
  • Test exploit with WindowsIdentity (this gadget relies on the TypeConfuseDelegate allowing them to be tested simultaneously)

[cdelafuente-r7]

This is a great library! Thanks for writing this.
I left a few comments for you to review. I am starting to test the modules that have been modified now.

[OJ]

This a great submission @zeroSteiner :) Love ya work mate.

[cdelafuente-r7]

@zeroSteiner, thanks for addressing these comments.

I tested the windows/http/ssrs_navcorrector_viewstate and windows/http/dnn_cookie_deserialization_rce modules with the latest version and everything works as expected.

Once @OJ approves the last changes, I will go ahead and land it.

[wvu]

This is great, since I was about to use it for something. :-)

[wvu]

[wvu]

@cdelafuente-r7: @OJ has marked his comments resolved. This wasn't blocked. :)

[cdelafuente-r7]

Release Notes

This improves the .NET deserialization library by adding two new chains, TypeConfuseDelegate and WindowsIdentity. A new formatter, SoapFormatter, and updating the applicable modules to use them.