I'm working on a vulnerability within an application that uses .NET Remoting. I can see from the code that there are a number of potential ways to get RCE, but due to how the application performs its communications I cannot just replay the traffic with a modified payload that triggers the vulnerability.

I would ordinarily just patch the binary to include my own IL, but there's a huge amount of code and it is proving excessively difficult to identify all the areas I would need to change in order to generate a functioning payload from within the normal application. I could also modify the visibility flags on the classes and load the application binary into my own custom program, then (ab)use its features there, but the full procedure for setting up a communications channel is very involved and it would require a lot of effort on my behalf.

What would help a lot in this situation is the ability to see what functions are being called via remoting, and what the passed parameters are. From what I can tell, though, there isn't a Wireshark dissector, nor could I find any tools to pull remoting traffic apart. Is there a way to do this? Are there any tools I could use?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.