.NET Remoting 漏洞分析：SolarWinds ARM 漏洞深度解析<\/h1>

1. 漏洞概述<\/h2>

本教学文档将深入分析 SolarWinds Access Rights Manager (ARM) 中的 .NET Remoting 漏洞（CVE-2023-35187），这是一个允许远程攻击者在受影响系统上执行任意代码的高危漏洞。<\/p>

关键漏洞信息<\/strong>：<\/p>

漏洞编号：CVE-2023-35187<\/li>
影响组件：SolarWinds Access Rights Manager<\/li>
认证要求：无需认证即可利用<\/li>
漏洞位置：OpenClientUpdateFile<\/code> 方法<\/li>
根本原因：使用用户提供的路径前缺乏适当验证<\/li>
影响范围：可在 SYSTEM 上下文中执行代码<\/li> <\/ul> 2. 漏洞技术分析<\/h2> 2.1 漏洞代码分析<\/h3> 漏洞存在于 TattleImplementation<\/code> 类中的 OpenClientUpdateFile<\/code> 方法：<\/p> public<\/span> class<\/span> TattleImplementation<\/span> : RemotingObject, ITattle, IPing { <\/span><\/span> public<\/span> Guid OpenClientUpdateFile(string<\/span> fileName) { <\/span><\/span> Guid guid2; <\/span><\/span> using<\/span> (MethodCall methodCall = new<\/span> MethodCall(this<\/span>)) { <\/span><\/span> Guid guid = Guid.NewGuid(); <\/span><\/span> using<\/span> (this<\/span>.fileStreams.Lock()) { <\/span><\/span> this<\/span>.fileStreams.Add(guid, new<\/span> FileStream( <\/span><\/span> Path.Combine(ApplicationPaths.Instance.InstallationPath, fileName), <\/span><\/span> FileMode.Open, <\/span><\/span> FileAccess.Read)); <\/span><\/span> } <\/span><\/span> guid2 = methodCall.SetResult(guid); <\/span><\/span> } <\/span><\/span> return<\/span> guid2; <\/span><\/span> } <\/span><\/span> <\/span><\/span> public<\/span> byte<\/span>[] ReadClientUpdateFile(Guid updateId, int<\/span> maxBytes) { <\/span><\/span> byte<\/span>[] array = new<\/span> byte<\/span>[maxBytes]; <\/span><\/span> int<\/span> num; <\/span><\/span> using<\/span> (this<\/span>.fileStreams.Lock()) { <\/span><\/span> num = this<\/span>.fileStreams[updateId].Read(array, 0<\/span>, maxBytes); <\/span><\/span> } <\/span><\/span> Array.Resize(ref<\/span> array, num); <\/span><\/span> return<\/span> array; <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>漏洞利用链<\/strong>：<\/p> 攻击者调用 OpenClientUpdateFile<\/code> 方法，传入任意文件路径<\/li> 方法返回一个 GUID<\/li> 攻击者使用该 GUID 调用 ReadClientUpdateFile<\/code> 方法<\/li> 系统读取并返回指定文件的内容<\/li> <\/ol> 2.2 Remoting 实现分析<\/h3> TattleImplementation<\/code> 继承自 RemotingObject<\/code>，后者继承自 MarshalByRefObject<\/code>：<\/p> public<\/span> abstract<\/span> class<\/span> RemotingObject<\/span> : MarshalByRefObject, IDisposable, IPing { <\/span><\/span> public<\/span> override<\/span> object<\/span> InitializeLifetimeService() { <\/span><\/span> return<\/span> null<\/span>; \/\/ 使对象永久存活<\/span> <\/span><\/span> } <\/span><\/span> <\/span><\/span> public<\/span> string<\/span> Ping(string<\/span> packet) { <\/span><\/span> return<\/span> packet; <\/span><\/span> } <\/span><\/span> <\/span><\/span> public<\/span> void<\/span> InstantiateInterface() {} <\/span><\/span> <\/span><\/span> public<\/span> virtual<\/span> void<\/span> Dispose() { <\/span><\/span> RemotingServices.Disconnect(this<\/span>); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>3. GRPC 自定义 Channel 实现<\/h2> SolarWinds ARM 使用自定义的 GrpcServerChannel<\/code> 实现 .NET Remoting 功能：<\/p> 3.1 Channel 注册<\/h3> private<\/span> int<\/span> createGlobalServerChannelInternal(int<\/span> port, bool<\/span> selectServerPort) { <\/span><\/span> string<\/span> text = string<\/span>.Format("port_{0}"<\/span>, port); <\/span><\/span> object<\/span> obj = this<\/span>.channelAccess; <\/span><\/span> lock<\/span> (obj) { <\/span><\/span> IDictionary dictionary = new<\/span> Hashtable(); <\/span><\/span> dictionary["includeVersions"<\/span>] = false<\/span>; <\/span><\/span> dictionary["typeFilterLevel"<\/span>] = TypeFilterLevel.Full.ToString(); <\/span><\/span> <\/span><\/span> IServerChannelSinkProvider serverChannelSinkProvider2; <\/span><\/span> if<\/span> (!this<\/span>.applicationConfiguration.GetValue("network.dump.enabled"<\/span>, false<\/span>)) { <\/span><\/span> IServerChannelSinkProvider serverChannelSinkProvider = <\/span><\/span> new<\/span> BinaryServerFormatterSinkProvider(dictionary, null<\/span>); <\/span><\/span> serverChannelSinkProvider2 = serverChannelSinkProvider; <\/span><\/span> <\/span><\/span> IChannelReceiver channelReceiver; <\/span><\/span> if<\/span> (selectServerPort || port > 0<\/span>) { <\/span><\/span> channelReceiver = new<\/span> GrpcServerChannel(this<\/span>.grpcManager, text, port, serverChannelSinkProvider3); <\/span><\/span> ChannelServices.RegisterChannel(channelReceiver, false<\/span>); <\/span><\/span> } <\/span><\/span> } <\/span><\/span> return<\/span> this<\/span>.grpcManager.LocalPort; <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>关键配置<\/strong>：<\/p> typeFilterLevel<\/code> 设置为 Full<\/code>（允许反序列化所有类型）<\/li> 使用 BinaryServerFormatterSinkProvider<\/code> 进行序列化<\/li> <\/ul> 3.2 Sink Chain 结构<\/h3> 完整的 Sink Chain 如下：<\/p> GrpcRemotingService (GrpcRemotingService#send → GrpcRemotingService#HandelRequest) → BinaryServerFormatterSink → Dispatch <\/code><\/pre> 4. 漏洞利用方法<\/h2> 4.1 服务端点<\/h3> 以下是 SolarWinds ARM 中可用的 Remoting 服务端点：<\/p> URI Service<\/th> 实现类<\/th> <\/tr> <\/thead> wusel<\/td> WuselImplementation<\/td> <\/tr> pn.server<\/td> gaffer<\/td> <\/tr> pn.gaffer<\/td> tattle<\/td> <\/tr> pn.server<\/td> update<\/td> <\/tr> pn.update<\/td> tracerServer<\/td> <\/tr> pn.tracer<\/td> farmServer<\/td> <\/tr> pn.server.farm<\/td> tracerCenter<\/td> <\/tr> pn.tracer<\/td> jobCenter<\/td> <\/tr> pn.jobs<\/td> GenericGafferCredentialService<\/td> <\/tr> pn.connectors.generic.gaffer<\/td> logService<\/td> <\/tr> pn.server<\/td> ServerDebugger<\/td> <\/tr> <\/tbody> <\/table> 4.2 利用步骤<\/h3> 构造 GrpcClientChannel 连接到 grpc:\/\/IP:5555\/tattle<\/code><\/li> 调用 OpenClientUpdateFile<\/code> 方法获取文件句柄<\/li> 使用返回的 GUID 调用 ReadClientUpdateFile<\/code> 读取文件内容<\/li> <\/ol> 升级到 RCE<\/strong>：可以利用 .erlang.cookie<\/code> 文件（位于 C:\ProgramData\SolarWinds\Orion\RabbitMQ\.erlang.cookie<\/code>）进行权限提升。<\/p> 5. 代码审计关注点<\/h2> 在审计 .NET Remoting 实现时，应重点关注以下方面：<\/p> TypeFilterLevel 设置<\/strong>：<\/p> 检查是否设置为 Full<\/code>（高风险）<\/li> 理想情况下应设置为 Low<\/code><\/li> <\/ul> <\/li> 自定义 Channel 实现<\/strong>：<\/p> 检查传输协议实现（GRPC、UDP、WebSocket 等）<\/li> 分析 Sink Chain 结构<\/li> <\/ul> <\/li> MBR 类方法<\/strong>：<\/p> 检查所有 MarshalByRefObject 派生类<\/li> 识别危险方法（文件操作、命令执行等）<\/li> <\/ul> <\/li> 认证与授权<\/strong>：<\/p> 检查是否实现了适当的认证机制<\/li> 验证方法调用权限控制<\/li> <\/ul> <\/li> 输入验证<\/strong>：<\/p> 检查所有用户提供的输入是否经过严格验证<\/li> 特别注意文件路径、命令参数等敏感输入<\/li> <\/ul> <\/li> <\/ol> 6. 防御建议<\/h2> 禁用不必要的 Remoting 服务<\/strong><\/li> 将 TypeFilterLevel 设置为 Low<\/strong><\/li> 实现强认证机制<\/strong><\/li> 对所有用户输入进行严格验证<\/strong><\/li> 使用网络隔离限制访问<\/strong><\/li> 及时应用安全补丁<\/strong><\/li> <\/ol> 通过深入理解这些漏洞原理和实现细节，安全研究人员可以更有效地发现和防御类似的 .NET Remoting 安全问题。<\/p>

URI Service<\/th>	实现类<\/th> <\/tr> <\/thead>
wusel<\/td>	WuselImplementation<\/td> <\/tr>
pn.server<\/td>	gaffer<\/td> <\/tr>
pn.gaffer<\/td>	tattle<\/td> <\/tr>
pn.server<\/td>	update<\/td> <\/tr>
pn.update<\/td>	tracerServer<\/td> <\/tr>
pn.tracer<\/td>	farmServer<\/td> <\/tr>
pn.server.farm<\/td>	tracerCenter<\/td> <\/tr>
pn.tracer<\/td>	jobCenter<\/td> <\/tr>
pn.jobs<\/td>	GenericGafferCredentialService<\/td> <\/tr>
pn.connectors.generic.gaffer<\/td>	logService<\/td> <\/tr>
pn.server<\/td>	ServerDebugger<\/td> <\/tr> <\/tbody> <\/table> 4.2 利用步骤<\/h3> 构造 GrpcClientChannel 连接到 `grpc:\/\/IP:5555\/tattle<\/code><\/li>` `调用 OpenClientUpdateFile<\/code> 方法获取文件句柄<\/li>` 使用返回的 GUID 调用 ReadClientUpdateFile<\/code> 读取文件内容<\/li> <\/ol> 升级到 RCE<\/strong>：可以利用 .erlang.cookie<\/code> 文件（位于 C:\ProgramData\SolarWinds\Orion\RabbitMQ\.erlang.cookie<\/code>）进行权限提升。<\/p> 5. 代码审计关注点<\/h2> 在审计 .NET Remoting 实现时，应重点关注以下方面：<\/p> TypeFilterLevel 设置<\/strong>：<\/p> 检查是否设置为 Full<\/code>（高风险）<\/li> 理想情况下应设置为 Low<\/code><\/li> <\/ul> <\/li> 自定义 Channel 实现<\/strong>：<\/p> 检查传输协议实现（GRPC、UDP、WebSocket 等）<\/li> 分析 Sink Chain 结构<\/li> <\/ul> <\/li> MBR 类方法<\/strong>：<\/p> 检查所有 MarshalByRefObject 派生类<\/li> 识别危险方法（文件操作、命令执行等）<\/li> <\/ul> <\/li> 认证与授权<\/strong>：<\/p> 检查是否实现了适当的认证机制<\/li> 验证方法调用权限控制<\/li> <\/ul> <\/li> 输入验证<\/strong>：<\/p> 检查所有用户提供的输入是否经过严格验证<\/li> 特别注意文件路径、命令参数等敏感输入<\/li> <\/ul> <\/li> <\/ol> 6. 防御建议<\/h2> 禁用不必要的 Remoting 服务<\/strong><\/li> 将 TypeFilterLevel 设置为 Low<\/strong><\/li> 实现强认证机制<\/strong><\/li> 对所有用户输入进行严格验证<\/strong><\/li> 使用网络隔离限制访问<\/strong><\/li> 及时应用安全补丁<\/strong><\/li> <\/ol> 通过深入理解这些漏洞原理和实现细节，安全研究人员可以更有效地发现和防御类似的 .NET Remoting 安全问题。<\/p>