Chapter 7 - DotNetNuke Cookie Deserialization RCE

Overview

This chapter explores the Remote Code Execution (RCE) vulnerability due to deserialization issues in DotNetNuke (DNN), a popular .NET-based content management system. This vulnerability allows an attacker to execute arbitrary code on the server by manipulating serialized data within cookies.

Getting Started

• Environment Setup: Establish a testing environment with DotNetNuke installed. Make sure it is configured to the vulnerable version detailed in the course materials.
• Required Tools: Prepare tools such as dnSpy for decompiling .NET assemblies, a web proxy like Burp Suite to intercept and modify HTTP requests, and a network sniffer for monitoring traffic.

Vulnerability Discovery

1. Cookie Handling in DNN:
   • Investigate how DNN handles user session and authentication cookies.
   • Check for the use of serialized data within cookies.

GET / HTTP/1.1 
Host: vulnerable-dnn.com 
Cookie: dnn_IsMobile=False; .DOTNETNUKE=<serialized_data>; path=/; HttpOnly

2. Deserialization of Cookie Data:
   • Review the source code or decompiled .NET assemblies to understand how DNN deserializes cookie data.
   • Identify insecure deserialization vulnerabilities where untrusted data is deserialized without adequate security checks.

Exploitation of the Vulnerability

1. Crafting Malicious Serialized Objects:
   • Use tools like ysoserial.net to generate malicious payloads that exploit the deserialization vulnerability.
   • Embed these payloads into the DNN cookie.

ysoserial -f BinaryFormatter -g ObjectDataProvider -c "calc.exe" -o base64

2. Injecting the Payload into Cookies:
   • Modify your HTTP requests to include the malicious serialized payload in the cookie.
   • Use a web proxy to send the modified request to the server and initiate the payload.

GET / HTTP/1.1 
Host: vulnerable-dnn.com 
Cookie: dnn_IsMobile=False; .DOTNETNUKE=<malicious_serialized_data>; path=/; HttpOnly

3. Achieving Remote Code Execution:
   • Observe the server response to confirm successful exploitation.
   • If successful, arbitrary commands are executed on the server, confirming RCE.

Summary

This chapter underscores the critical importance of proper input validation and secure coding practices to mitigate serialization vulnerabilities. It provides a detailed walkthrough of exploiting such vulnerabilities in DotNetNuke, highlighting both the theoretical and practical aspects of the attack.