Lab 172 — PulseGuard — Insecure Deserialization via JSON.NET TypeNameHandling

hackadvisor

Task: ASP.NET Core monitoring platform uses Newtonsoft.Json TypeNameHandling on heartbeat API endpoint, accepting polymorphic $type in Metrics field. Solution: inject application-specific SystemDiagnostic type whose ScriptPath property setter executes OS commands during deserialization; discovered via timing-based property brute force with sleep; exfiltrate flag by copying to webroot.