.Net反序列化之ViewState利用 – 作者:知道创宇404实验室

LosFormatter formatter = new LosFormatter();
object viewstateObj = formatter.Deserialize("/wEPDwULLTE2MTY2ODcyMjkPFgIeCHBhc3N3b3JkBQlzd29yZGZpc2hkZA==");

<%@ Page ViewStateEncryptionMode="Always" %>

<%@ Page EnableViewStateMac="true" %>

<pages enableViewState="false" enableViewStateMac="false" viewStateEncryptionMode="Always" />

<machineKey validationKey="[String]"  decryptionKey="[String]" validation="[SHA1 | MD5 | 3DES | AES | HMACSHA256 | HMACSHA384 | HMACSHA512 | alg:algorithm_name]"  decryption="[Auto | DES | 3DES | AES | alg:algorithm_name]" />

<machineKey validationKey="BF579EF0E9F0C85277E75726BFC9D0260FADE8DE2864A583484AA132944F602D" decryptionKey="51FE611365277B07911521B7CAFE3766751D16C33D96242F0E63E93FB102BCE2" validation="HMACSHA256" />

private string Serialize(object stateGraph, Purpose purpose) {
    string result = null;

    MemoryStream ms = GetMemoryStream();
    try {
        Serialize(ms, stateGraph);
        ms.SetLength(ms.Position);

        byte[] buffer = ms.GetBuffer();
        int length = (int)ms.Length;

#if !FEATURE_PAL // FEATURE_PAL does not enable cryptography
        // We only support serialization of encrypted or encoded data through our internal Page constructors

        if (AspNetCryptoServiceProvider.Instance.IsDefaultProvider && !_forceLegacyCryptography) {
            // If we're configured to use the new crypto providers, call into them if encryption or signing (or both) is requested.
            ...
        }
        else {
            // Otherwise go through legacy crypto mechanisms
#pragma warning disable 618 // calling obsolete methods
            if (_page != null && _page.RequiresViewStateEncryptionInternal) {
                buffer = MachineKeySection.EncryptOrDecryptData(true, buffer, GetMacKeyModifier(), 0, length);
                length = buffer.Length;
            }
            // We need to encode if the page has EnableViewStateMac or we got passed in some mac key string
            else if ((_page != null && _page.EnableViewStateMac) || _macKeyBytes != null) {
                buffer = MachineKeySection.GetEncodedData(buffer, GetMacKeyModifier(), 0, ref length);
            }
#pragma warning restore 618 // calling obsolete methods
        }

#endif // !FEATURE_PAL
        result = Convert.ToBase64String(buffer, 0, length);
    }
    finally {
        ReleaseMemoryStream(ms);
    }
    return result;
}

MemoryStream ms = GetMemoryStream();
    try {
        Serialize(ms, stateGraph);
        ms.SetLength(ms.Position);
        ...

if (_page != null && _page.RequiresViewStateEncryptionInternal) {
    buffer = MachineKeySection.EncryptOrDecryptData(true, buffer, GetMacKeyModifier(), 0, length);
    length = buffer.Length;
}
// We need to encode if the page has EnableViewStateMac or we got passed in some mac key string
else if ((_page != null && _page.EnableViewStateMac) || _macKeyBytes != null) {
    buffer = MachineKeySection.GetEncodedData(buffer, GetMacKeyModifier(), 0, ref length);
}

internal bool RequiresViewStateEncryptionInternal {
    get {
        return ViewStateEncryptionMode == ViewStateEncryptionMode.Always ||
               _viewStateEncryptionRequested && ViewStateEncryptionMode == ViewStateEncryptionMode.Auto;
    }
}

public bool EnableViewStateMac {
    get { return _enableViewStateMac; }
    set {
        // DevDiv #461378: EnableViewStateMac=false can lead to remote code execution, so we
        // have an mechanism that forces this to keep its default value of 'true'. We only
        // allow actually setting the value if this enforcement mechanism is inactive.
        if (!EnableViewStateMacRegistryHelper.EnforceViewStateMac) {
            _enableViewStateMac = value;
        }
    }
}

public Page() {
    _page = this;   // Set the page to ourselves

    _enableViewStateMac = EnableViewStateMacDefault;
    ...
}

// Returns 'true' if the EnableViewStateMac patch (DevDiv #461378) is enabled,
// meaning that we always enforce EnableViewStateMac=true. Returns 'false' if
// the patch hasn't been activated on this machine.
public static readonly bool EnforceViewStateMac;

static EnableViewStateMacRegistryHelper() {
    // If the reg key is applied, change the default values.
    bool regKeyIsActive = IsMacEnforcementEnabledViaRegistry();
    if (regKeyIsActive) {
        EnforceViewStateMac = true;
        SuppressMacValidationErrorsFromCrossPagePostbacks = true;
    }

    // Override the defaults with what the developer specified.
    if (AppSettings.AllowInsecureDeserialization.HasValue) {
        EnforceViewStateMac = !AppSettings.AllowInsecureDeserialization.Value;

        // Exception: MAC errors from cross-page postbacks should be suppressed
        // if either the <appSettings> switch is set or the reg key is set.
        SuppressMacValidationErrorsFromCrossPagePostbacks |= !AppSettings.AllowInsecureDeserialization.Value;
    }
    ...

private static bool IsMacEnforcementEnabledViaRegistry() {
    try {
        string keyName = String.Format(CultureInfo.InvariantCulture, @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v{0}", Environment.Version.ToString(3));
        int rawValue = (int)Registry.GetValue(keyName, "AspNetEnforceViewStateMac", defaultValue: 0 /* disabled by default */);
        return (rawValue != 0);
    }
    catch {
        // If we cannot read the registry for any reason, fail safe and assume enforcement is enabled.
        return true;
    }
}

<configuration>
…
    <appSettings>
      <add key="aspnet:AllowInsecureDeserialization" value="true" />
    </appSettings>
</configuration>

private object Deserialize(string inputString, Purpose purpose) {
    if (String.IsNullOrEmpty(inputString)) {
        throw new ArgumentNullException("inputString");
    }

    byte[] inputBytes = Convert.FromBase64String(inputString);
    int length = inputBytes.Length;

#if !FEATURE_PAL // FEATURE_PAL does not enable cryptography
    try {
        if (AspNetCryptoServiceProvider.Instance.IsDefaultProvider && !_forceLegacyCryptography) {
            // If we're configured to use the new crypto providers, call into them if encryption or signing (or both) is requested.
            ...
        }
        else {
            // Otherwise go through legacy crypto mechanisms
#pragma warning disable 618 // calling obsolete methods
            if (_page != null && _page.ContainsEncryptedViewState) {
                inputBytes = MachineKeySection.EncryptOrDecryptData(false, inputBytes, GetMacKeyModifier(), 0, length);
                length = inputBytes.Length;
            }
            // We need to decode if the page has EnableViewStateMac or we got passed in some mac key string
            else if ((_page != null && _page.EnableViewStateMac) || _macKeyBytes != null) {
                inputBytes = MachineKeySection.GetDecodedData(inputBytes, GetMacKeyModifier(), 0, length, ref length);
            }
#pragma warning restore 618 // calling obsolete methods
        }
    }
    catch {
        // MSRC 10405: Don't propagate inner exceptions, as they may contain sensitive cryptographic information.
        PerfCounters.IncrementCounter(AppPerfCounter.VIEWSTATE_MAC_FAIL);
        ViewStateException.ThrowMacValidationError(null, inputString);
    }
#endif // !FEATURE_PAL
    object result = null;
    MemoryStream objectStream = GetMemoryStream();
    try {
        objectStream.Write(inputBytes, 0, length);
        objectStream.Position = 0;
        result = Deserialize(objectStream);
    }
    finally {
        ReleaseMemoryStream(objectStream);
    }
    return result;
}

else {
    // Otherwise go through legacy crypto mechanisms
    if (_page != null && _page.ContainsEncryptedViewState) {
        inputBytes = MachineKeySection.EncryptOrDecryptData(false, inputBytes, GetMacKeyModifier(), 0, length);
        length = inputBytes.Length;
    }
    // We need to decode if the page has EnableViewStateMac or we got passed in some mac key string
    else if ((_page != null && _page.EnableViewStateMac) || _macKeyBytes != null) {
        inputBytes = MachineKeySection.GetDecodedData(inputBytes, GetMacKeyModifier(), 0, length, ref length);
    }
}

if (_requestValueCollection != null) {

     // Determine if viewstate was encrypted.
     if (_requestValueCollection[ViewStateEncryptionID] != null) {
         ContainsEncryptedViewState = true;
     }
    ...

// NOTE: When encoding the data, this method *may* return the same reference to the input "buf" parameter
// with the hash appended in the end if there's enough space.  The "length" parameter would also be
// appropriately adjusted in those cases.  This is an optimization to prevent unnecessary copying of
// buffers.
[Obsolete(OBSOLETE_CRYPTO_API_MESSAGE)]
internal static byte[] GetEncodedData(byte[] buf, byte[] modifier, int start, ref int length)
{
    EnsureConfig();

    byte[] bHash = HashData(buf, modifier, start, length);
    byte[] returnBuffer;

    if (buf.Length - start - length >= bHash.Length)
    {
        // Append hash to end of buffer if there's space
        Buffer.BlockCopy(bHash, 0, buf, start + length, bHash.Length);
        returnBuffer = buf;
    }
    else
    {
        returnBuffer = new byte[length + bHash.Length];
        Buffer.BlockCopy(buf, start, returnBuffer, 0, length);
        Buffer.BlockCopy(bHash, 0, returnBuffer, length, bHash.Length);
        start = 0;
    }
    length += bHash.Length;

    if (s_config.Validation == MachineKeyValidation.TripleDES || s_config.Validation == MachineKeyValidation.AES) {
        returnBuffer = EncryptOrDecryptData(true, returnBuffer, modifier, start, length, true);
        length = returnBuffer.Length;
    }
    return returnBuffer;
}

internal static byte[] HashData(byte[] buf, byte[] modifier, int start, int length)
{
    EnsureConfig();

    if (s_config.Validation == MachineKeyValidation.MD5)
        return HashDataUsingNonKeyedAlgorithm(null, buf, modifier, start, length, s_validationKey);
    if (_UseHMACSHA) {
        byte [] hash = GetHMACSHA1Hash(buf, modifier, start, length);
        if (hash != null)
            return hash;
    }
    if (_CustomValidationTypeIsKeyed) {
        return HashDataUsingKeyedAlgorithm(KeyedHashAlgorithm.Create(_CustomValidationName),
                                           buf, modifier, start, length, s_validationKey);
    } else {
        return HashDataUsingNonKeyedAlgorithm(HashAlgorithm.Create(_CustomValidationName),
                                              buf, modifier, start, length, s_validationKey);
    }
}

private void InitValidationAndEncyptionSizes()
        {
            _CustomValidationName = ValidationAlgorithm;
            _CustomValidationTypeIsKeyed = true;
            switch(ValidationAlgorithm)
            {
            case "AES":
            case "3DES":
                _UseHMACSHA = true;
                _HashSize = SHA1_HASH_SIZE;
                _AutoGenValidationKeySize = SHA1_KEY_SIZE;
                break;
            case "SHA1":
                _UseHMACSHA = true;
                _HashSize = SHA1_HASH_SIZE;
                _AutoGenValidationKeySize = SHA1_KEY_SIZE;
                break;
            case "MD5":
                _CustomValidationTypeIsKeyed = false;
                _UseHMACSHA = false;
                _HashSize = MD5_HASH_SIZE;
                _AutoGenValidationKeySize = MD5_KEY_SIZE;
                break;
            case "HMACSHA256":
                _UseHMACSHA = true;
                _HashSize = HMACSHA256_HASH_SIZE;
                _AutoGenValidationKeySize = HMACSHA256_KEY_SIZE;
                break;
            case "HMACSHA384":
                _UseHMACSHA = true;
                _HashSize = HMACSHA384_HASH_SIZE;
                _AutoGenValidationKeySize = HMACSHA384_KEY_SIZE;
                break;
            case "HMACSHA512":
                _UseHMACSHA = true;
                _HashSize = HMACSHA512_HASH_SIZE;
                _AutoGenValidationKeySize = HMACSHA512_KEY_SIZE;
                break;
            default:
                ...

private static byte[] HashDataUsingNonKeyedAlgorithm(HashAlgorithm hashAlgo, byte[] buf, byte[] modifier,
                                                     int start, int length, byte[] validationKey)
{
    int     totalLength = length + validationKey.Length + ((modifier != null) ? modifier.Length : 0);
    byte [] bAll        = new byte[totalLength];

    Buffer.BlockCopy(buf, start, bAll, 0, length);
    if (modifier != null) {
        Buffer.BlockCopy(modifier, 0, bAll, length, modifier.Length);
    }
    Buffer.BlockCopy(validationKey, 0, bAll, length, validationKey.Length);
    if (hashAlgo != null) {
        return hashAlgo.ComputeHash(bAll);
    } else {
        byte[] newHash = new byte[MD5_HASH_SIZE];
        int hr = UnsafeNativeMethods.GetSHA1Hash(bAll, bAll.Length, newHash, newHash.Length);
        Marshal.ThrowExceptionForHR(hr);
        return newHash;
    }
}

private const int MD5_KEY_SIZE          = 64;
  private const int MD5_HASH_SIZE         = 16;
  private const int SHA1_KEY_SIZE         = 64;
  private const int HMACSHA256_KEY_SIZE       = 64;
  private const int HMACSHA384_KEY_SIZE       = 128;
  private const int HMACSHA512_KEY_SIZE       = 128;
  private const int SHA1_HASH_SIZE        = 20;
  private const int HMACSHA256_HASH_SIZE      = 32;
  private const int HMACSHA384_HASH_SIZE      = 48;
  private const int HMACSHA512_HASH_SIZE      = 64;

private static byte[] GetHMACSHA1Hash(byte[] buf, byte[] modifier, int start, int length) {
    if (start < 0 || start > buf.Length)
        throw new ArgumentException(SR.GetString(SR.InvalidArgumentValue, "start"));
    if (length < 0 || buf == null || (start + length) > buf.Length)
        throw new ArgumentException(SR.GetString(SR.InvalidArgumentValue, "length"));
    byte[] hash = new byte[_HashSize];
    int hr = UnsafeNativeMethods.GetHMACSHA1Hash(buf, start, length,
                                                 modifier, (modifier == null) ? 0 : modifier.Length,
                                                 s_inner, s_inner.Length, s_outer, s_outer.Length,
                                                 hash, hash.Length);
    if (hr == 0)
        return hash;
    _UseHMACSHA = false;
    return null;
}

internal static byte[] EncryptOrDecryptData(bool fEncrypt, byte[] buf, byte[] modifier, int start, int length, bool useValidationSymAlgo, bool useLegacyMode, IVType ivType, bool signData)

/* This algorithm is used to perform encryption or decryption of a buffer, along with optional signing (for encryption)
 * or signature verification (for decryption). Possible operation modes are:
 * 
 * ENCRYPT + SIGN DATA (fEncrypt = true, signData = true)
 * Input: buf represents plaintext to encrypt, modifier represents data to be appended to buf (but isn't part of the plaintext itself)
 * Output: E(iv + buf + modifier) + HMAC(E(iv + buf + modifier))
 * 
 * ONLY ENCRYPT DATA (fEncrypt = true, signData = false)
 * Input: buf represents plaintext to encrypt, modifier represents data to be appended to buf (but isn't part of the plaintext itself)
 * Output: E(iv + buf + modifier)
 * 
 * VERIFY + DECRYPT DATA (fEncrypt = false, signData = true)
 * Input: buf represents ciphertext to decrypt, modifier represents data to be removed from the end of the plaintext (since it's not really plaintext data)
 * Input (buf): E(iv + m + modifier) + HMAC(E(iv + m + modifier))
 * Output: m
 * 
 * ONLY DECRYPT DATA (fEncrypt = false, signData = false)
 * Input: buf represents ciphertext to decrypt, modifier represents data to be removed from the end of the plaintext (since it's not really plaintext data)
 * Input (buf): E(iv + plaintext + modifier)
 * Output: m
 * 
 * The 'iv' in the above descriptions isn't an actual IV. Rather, if ivType = IVType.Random, we'll prepend random bytes ('iv')
 * to the plaintext before feeding it to the crypto algorithms. Introducing randomness early in the algorithm prevents users
 * from inspecting two ciphertexts to see if the plaintexts are related. If ivType = IVType.None, then 'iv' is simply
 * an empty string. If ivType = IVType.Hash, we use a non-keyed hash of the plaintext.
 * 
 * The 'modifier' in the above descriptions is a piece of metadata that should be encrypted along with the plaintext but
 * which isn't actually part of the plaintext itself. It can be used for storing things like the user name for whom this
 * plaintext was generated, the page that generated the plaintext, etc. On decryption, the modifier parameter is compared
 * against the modifier stored in the crypto stream, and it is stripped from the message before the plaintext is returned.
 * 
 * In all cases, if something goes wrong (e.g. invalid padding, invalid signature, invalid modifier, etc.), a generic exception is thrown.
 */

internal static byte[] EncryptOrDecryptData(bool fEncrypt, byte[] buf, byte[] modifier, int start, int length, bool useValidationSymAlgo, bool useLegacyMode, IVType ivType, bool signData)

// 541~543行
System.IO.MemoryStream ms = new System.IO.MemoryStream();
ICryptoTransform cryptoTransform = GetCryptoTransform(fEncrypt, useValidationSymAlgo, useLegacyMode);
CryptoStream cs = new CryptoStream(ms, cryptoTransform, CryptoStreamMode.Write);

private static ICryptoTransform GetCryptoTransform(bool fEncrypt, bool useValidationSymAlgo, bool legacyMode)
{
    SymmetricAlgorithm algo = (legacyMode ? s_oSymAlgoLegacy : (useValidationSymAlgo ? s_oSymAlgoValidation : s_oSymAlgoDecryption));
    lock(algo)
        return (fEncrypt ? algo.CreateEncryptor() : algo.CreateDecryptor());
}

switch (Decryption)
{
case "3DES":
    s_oSymAlgoDecryption = CryptoAlgorithms.CreateTripleDES();
    break;
case "DES":
    s_oSymAlgoDecryption = CryptoAlgorithms.CreateDES();
    break;
case "AES":
    s_oSymAlgoDecryption = CryptoAlgorithms.CreateAes();
    break;
case "Auto":
    if (dKey.Length == 8) {
        s_oSymAlgoDecryption = CryptoAlgorithms.CreateDES();
    } else {
        s_oSymAlgoDecryption = CryptoAlgorithms.CreateAes();
    }
    break;
}

if (s_oSymAlgoDecryption == null) // Shouldn't happen!
    InitValidationAndEncyptionSizes();

switch(Validation)
{
case MachineKeyValidation.TripleDES:
    if (dKey.Length == 8) {
        s_oSymAlgoValidation = CryptoAlgorithms.CreateDES();
    } else {
        s_oSymAlgoValidation = CryptoAlgorithms.CreateTripleDES();
    }
    break;
case MachineKeyValidation.AES:
    s_oSymAlgoValidation = CryptoAlgorithms.CreateAes();
    break;
}

// 第545~579行
// DevDiv Bugs 137864: Add IV to beginning of data to be encrypted.
// IVType.None is used by MembershipProvider which requires compatibility even in SP2 mode (and will set signData = false).
// MSRC 10405: If signData is set to true, we must generate an IV.
bool createIV = signData || ((ivType != IVType.None) && (CompatMode > MachineKeyCompatibilityMode.Framework20SP1));

if (fEncrypt && createIV)
{
    int ivLength = (useValidationSymAlgo ? _IVLengthValidation : _IVLengthDecryption);
    byte[] iv = null;

    switch (ivType) {
        case IVType.Hash:
            // iv := H(buf)
            iv = GetIVHash(buf, ivLength);
            break;

        case IVType.Random:
            // iv := [random]
            iv = new byte[ivLength];
            RandomNumberGenerator.GetBytes(iv);
            break;
    }

    Debug.Assert(iv != null, "Invalid value for IVType: " + ivType.ToString("G"));
    cs.Write(iv, 0, iv.Length);
}

cs.Write(buf, start, length);
if (fEncrypt && modifier != null)
{
    cs.Write(modifier, 0, modifier.Length);
}

cs.FlushFinalBlock();
byte[] paddedData = ms.ToArray();

// 第550~644行
// DevDiv Bugs 137864: Strip IV from beginning of unencrypted data
if (!fEncrypt && createIV)
{
    // strip off the first bytes that were random bits
    ...
}
else
{
    bData = paddedData;
}
...
// At this point:
// If fEncrypt = true (encrypting), bData := Enc(iv + buf + modifier)
// If fEncrypt = false (decrypting), bData := plaintext

if (fEncrypt && signData) {
    byte[] hmac = HashData(bData, null, 0, bData.Length);
    byte[] bData2 = new byte[bData.Length + hmac.Length];

    Buffer.BlockCopy(bData, 0, bData2, 0, bData.Length);
    Buffer.BlockCopy(hmac, 0, bData2, bData.Length, hmac.Length);
    bData = bData2;
}

// At this point:
// If fEncrypt = true (encrypting), bData := Enc(iv + buf + modifier) + HMAC(Enc(iv + buf + modifier))
// If fEncrypt = false (decrypting), bData := plaintext

// And we're done
return bData;

// This will return the MacKeyModifier provided in the LOSFormatter constructor or
// generate one from Page if EnableViewStateMac is true.
private byte[] GetMacKeyModifier() {
    if (_macKeyBytes == null) {
        // Only generate a MacKeyModifier if we have a page
        if (_page == null) {
            return null;
        }

        // Note: duplicated (somewhat) in GetSpecificPurposes, keep in sync

        // Use the page's directory and class name as part of the key (ASURT 64044)
        uint pageHashCode = _page.GetClientStateIdentifier();

        string viewStateUserKey = _page.ViewStateUserKey;
        if (viewStateUserKey != null) {
            // Modify the key with the ViewStateUserKey, if any (ASURT 126375)
            int count = Encoding.Unicode.GetByteCount(viewStateUserKey);
            _macKeyBytes = new byte[count + 4];
            Encoding.Unicode.GetBytes(viewStateUserKey, 0, viewStateUserKey.Length, _macKeyBytes, 4);

        }
        else {
            _macKeyBytes = new byte[4];
        }

        _macKeyBytes[0] = (byte)pageHashCode;
        _macKeyBytes[1] = (byte)(pageHashCode >> 8);
        _macKeyBytes[2] = (byte)(pageHashCode >> 16);
        _macKeyBytes[3] = (byte)(pageHashCode >> 24);
    }
    return _macKeyBytes;
}

// This is a non-cryptographic hash code that can be used to identify which Page generated
// a __VIEWSTATE field. It shouldn't be considered sensitive information since its inputs
// are assumed to be known by all parties.
internal uint GetClientStateIdentifier() {
    // Use non-randomized hash code algorithms instead of String.GetHashCode.

    // Use the page's directory and class name as part of the key (ASURT 64044)
    // We need to make sure that the hash is case insensitive, since the file system
    // is, and strange view state errors could otherwise happen (ASURT 128657)
    int pageHashCode = StringUtil.GetNonRandomizedHashCode(TemplateSourceDirectory, ignoreCase:true);
    pageHashCode += StringUtil.GetNonRandomizedHashCode(GetType().Name, ignoreCase:true);

    return (uint)pageHashCode;
}