VulnerableDotNetHTTPRemoting

易受攻击的 Dot Net HTTP Remoting 项目 此存储库包含一个易受攻击的 C 应用程序（客户端/服务器），它使用基于 HTTP 的 .NET Remoting。这可用于测试目的，并且可以使用不同版本的 .NET Framework 进行编译。 它还包含一份 ysoserial.net（15/03/2018）的副本，该副本已由 irsdl 修改以适用于 .NET Framework 2.0。虽然此项目可用于攻击使用 .NET Framework v2.0 的应用程序，但它也需要目标机器上安装 .NET Framework 3.5，因为相关 gadgets 依赖它。如果将发现...

HttpRemotingObjRefLeak

通过 HTTP .NET Remoting 泄露和利用 ObjRef（CVE-2024-29059） 本仓库进一步提供了关于 CODE WHITE 同名博文 Leaking ObjRefs to Exploit HTTP .NET Remoting 的详细信息和资源： 1. 创建易受攻击的 ASP.NET Web 应用程序 2. 检测 ObjRef 泄漏 3. 在 TypeFilterLevel.Low 限制下可工作的示例反序列化载荷 4. 用于投递载荷的利用脚本 1. 创建易受攻击的 ASP.NET Web 应用程序 以下内容基于 Microsoft 的《为 ASP.NET 网站配置...

CVE-2019-7214

CVE-2019-7214 Exploit Title: SmarterMail...

CVE-2022-31199

CVE-2022-31199 - Netwrix Auditor RCE 漏洞利用 POC 🔍 漏洞概述 CVE-2022-31199 是 Netwrix Auditor 10.5 之前版本中存在的一个严重的不安全对象反序列化漏洞。该漏洞存在于监听 TCP 9004 端口的未受保护的 .NET Remoting 服务中，允许未经身份验证的远程攻击者以 NT AUTHORITY\SYSTEM 权限实现任意代码执行。 漏洞详情 CVE ID : CVE-2022-31199 CVSS 评分 : 9.8 严重 CWE : CWE-502 不可信数据的反序列化 受影响版本 : Netwrix...

CVE-2023-35813_PoC

curl -k -v -X POST "https://target/sitecorexaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "ISEVENT=1" --data-urlencode "SOURCE=" --data-urlencode "PARAMETERS=ParseControl" ""...

CVE-2026-58127

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET...

CVE-2026-58126 PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can...

CVE-2026-11858 Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated...

CVE-2026-11857 Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces only through named pipes. A local...

CVE-2026-11858: Missing Authorization

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient access controls or authorization. A local authenticated...

CVE-2026-11857: Deserialization of Untrusted Data

Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service due to insecure deserialization in the .NET Remoting service. The service is configured with TypeFilterLevel.Full and is bound to local interfaces only through named pipes. A local...

CVE-2026-25550

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

CVE-2026-0611

Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel exposed on port 8989 that allows attackers to perform arbitrary file read and write operations by...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

EUVD-2026-34306

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

CVE-2026-25551

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...

PT-2026-46297

Name of the Vulnerable Software and Affected Versions BarTender 2010 BarTender 2016 versions prior to R10 BarTender 2019 versions prior to R11 Description An unauthenticated remote code execution issue exists in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The...

CVE-2026-25550: Missing Authentication for Critical Function

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 = R9, and...