Exploiting .NET Remoting services
Although .NET Remoting is an older, officially deprecated technology, many enterprises still run services built on it. These legacy components often expose a surprisingly straightforward attack surface for remote‑code execution.
Successfully exploiting .NET Remoting, however, demands a solid understanding of its internal mechanisms, including object marshaling, channel configuration, serialization formatters and lease lifetimes.
In this hands‑on workshop we will equip participants with the full knowledge stack needed to discover, analyze, and compromise .NET Remoting endpoints. We start with the fundamentals and will progress to advanced exploitation techniques, like bypassing "TypeFilterLevel.Low" and CAS security.
Attendees will walk away with practical, reproducible examples, a checklist for identifying vulnerable implementations, and the skills to responsibly assess or remediate .NET Remoting in real‑world environments.
Although .NET Remoting is an older, officially deprecated technology, many enterprises still run services built on it. These legacy components often expose a surprisingly straightforward attack surface for remote‑code execution.
Successfully exploiting .NET Remoting, however, demands a solid understanding of its internal mechanisms, including object marshaling, channel configuration, serialization formatters and lease lifetimes.
In this hands‑on workshop we will equip participants with the full knowledge stack needed to discover, analyze, and compromise .NET Remoting endpoints. We start with the fundamentals and will progress to advanced exploitation techniques, like bypassing "TypeFilterLevel.Low" and CAS security.
Attendees will walk away with practical, reproducible examples, a checklist for identifying vulnerable implementations, and the skills to responsibly assess or remediate .NET Remoting in real‑world environments.
Hans-Martin is CEO of MOGWAI LABS, a small cyber security outfit from Neu-Ulm.