.Net Roulette Exploiting Insecure Deserialization in Telerik UI

DerpCon 2020 presentation reviews how .NET deserialization works and how to get shells on real applications.

Download Resource

Presentation by Caleb Gross at DerpCon 2020

In this presentation, we dig into the internals of CVE-2019-18935, a deserialization vulnerability that allows RCE on the popular web UI suite Telerik UI for ASP.NET AJAX.

After demonstrating how to exploit this issue step-by-step, you'll learn a hands-on approach to debugging a locally running ASP.NET application, quickly assessing the site's attack surface, and examining possible avenues for finding and exploiting insecure uses of deserialization. This presentation is for penetration testers and security researchers who'd like to begin testing deserialization vulnerabilities in .NET software.

Presentation includes:

  1. Exploit Demo
  2. Dispel the Magic
  3. .Net Serialization Primer
  4. Develop POC Exploit
  5. Practical ASP.NET pentest
Caleb Gross Light Gray

About the author, Caleb Gross

Director of Capability Development

Caleb Gross is the Director of the Capability Development at Bishop Fox where he leads a team of offensive security professionals specializing in attack surface research and vulnerability intelligence. Prior to coming to Bishop Fox, he served as an exploitation operator in the US Department of Defense's most elite computer network exploitation (CNE) unit. As a top-rated military officer, Caleb led an offensive operations team in the US Air Force's premier selectively manned cyber attack squadron.
More by Caleb

Extend Your Knowledge

Check out these related resources.

Adversarial Controls Testing Datasheet preview with purple background.
Datasheet

Adversarial Controls Testing Datasheet

Learn how Adversarial Controls Testing uses an attack-based approach mapped to the MITRE ATT&CK framework to determine the effectiveness of your email/phishing, endpoint, and network security controls.

Learn More
2024 Q3 DIGITAL DS Cosmos Service Now Tile
Datasheet

Cosmos for ServiceNow Datasheet

Learn how to effortlessly sync validated exposures from the Cosmos portal into your ServiceNow environment to streamline vulnerability management and remediate dangerous exposures before attackers can exploit them.
Learn More
Mockup of Bishop Fox's Guide to DORA Threat-Led Pen Testing
Guide

FAQ Guide: Acquiring DORA Threat-Led Penetration Testing

Bishop Fox’s comprehensive DORA FAQ guide walks you through everything you need to know about fulfilling these critical requirements. This resource is a must-have for financial institutions looking to stay ahead of DORA’s complex compliance landscape.

Learn More

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.