Kentico-12-RCE-via-SyncServer

KO | EN

gitlite — search

#javascript #typescript #llm #go #linux #macos #java #windows #kubernetes #awesome-list #pytorch #mcp #ios #open-source

Kentico-12-RCE-via-SyncServer

(★ 10)

Kentico <=12.0.14 is vulnerable to a remote code execution via the SyncServer

Kentico-12-RCE-via-SyncServer Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Kentico 11 & 12 Remote Code Execution

Kentico <=11.0.47 & <=12.0.14 versions are vulnerable to a remote code execution via the SyncServer.asmx.

A ysoserial.net payload is generated using the "ActivitySurrogateSelectorFromFile" gadget or by using the "WindowsIdentity" gadget. The payload would be constructed from a C# file which relates to the activity gadget and will perform a simple system execution function to run a specific command such as nslookup, ping, etc. Alternatively, if using the "WindowsIdentity" gadget, you can specify a command to be executed.

The payload will be submitted as a raw XML object to avoid misinterpretation from the server running the Kentico CMS. Then a SOAP request is sent with the payload to the server and the payload is being deserialized to perform the remote code execution.

### Example:

Windows terminal:
`python.exe kentico-exploit.py -g "WindowsIdentity" -c "cmd /c ping -n 5 <KALI_IP>"`

Upon successful request to the vulnerable server, the response code would most likely be 500:

![Example Run](https://raw.githubusercontent.com/Kr0ff/Kentico-12-RCE-via-SyncServer/master/pictures/exploit_example.gif)

Checking attacker's terminal with tcpdump running:

![tcpdump kali](https://raw.githubusercontent.com/Kr0ff/Kentico-12-RCE-via-SyncServer/master/pictures/tcpdump.png)

Thanks to:
    @Artur Gemes
    @Jake Bolam

For being of much help !

Reference: https://www.aon.com/cyber-solutions/aon_cyber_labs/unauthenticated-remote-code-execution-in-kentico-cms/

Kentico-12-RCE-via-SyncServer

Kentico-12-RCE-via-SyncServer Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Kentico-12-RCE-via-SyncServer

Kentico-12-RCE-via-SyncServer Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README