Dinis Cruz Blog: Using AST to programmatically create an Asmx WebServices WebMethod invocation wrapper (for HacmeBank)

Thursday, 16 May 2013

Using AST to programmatically create an Asmx WebServices WebMethod invocation wrapper (for HacmeBank)

Following the Creating a REPL editor that is linked to a Code editor and a Using AST technology (from ICSharpCode.NRefactory) to script the creation of a C# file posts, here is how use AST technology to create a wrapper for HacmeBank web services:

First we execute the webservices directly using:

which will create this AST generated script file (note: 'the script below was created from the script above', and that makes no sense to you, please read the Using AST technology (from ICSharpCode.NRefactory) to script the creation of a C# file post) :

which when executed results in:

Next step is to load the WS_UserManagement.cs file, get its AST, find the Login Method and add that method to the AClass Ast

The generated code will look like this:

One of the best parts of AST manipulation is that we can easily use on AST to create another one.

In this case we are going to use the WebService’s Login method to create the ‘wrapper/proxy login method’

The script shown above will create this script:

which is exactly what I’m trying to do: a C# based proxy for a web service :)

To quickly test it we can add a method that invoke that wrapper method:

which will create this code:

which when executed will show the login Id on the Log Viewer:

Here is an interesting twist, which also shows the power of this technique to script unit tests.

Since the Login method (in HacmeBank) is vulnerable to SQL injection, we can code a payload on via the AST generation:

which will result in the code and execution result of:

Note the SQL injection error in the Log :)

We can also use a payload that returns an SQL error with a value (like jv’ and 1 = @@version -- )

where we will get this script and execution result (see Log Viewer)

and this traffic in fiddler:

As you can see this is a real powerful technique where I was able to use AST manipulation to programmatically create a Proxy Method for a particular WebService’s WebMethod.

Finally, just to show the interactivity of this type of development (using the GUI explained in Creating a REPL editor that is linked to a Code editor ), this is what my GUI looked like after running the 'AST generated script with the SQL Injection' (note that right-hand-side code editor is populated, compiled and executed in real-time)

Scripts used in this Post:

1) invoking the Login WebService directly:

var compilationUnit = new CompilationUnit();

compilationUnit.add_Using("O2.DotNetWrappers.ExtensionMethods");

compilationUnit.add_Using("System");

  

var aClass  = compilationUnit.add_Type("AClass");

var aMethod = aClass.add_Method("Main")

                    .setReturnType("void") 

                    .public_Static();  

                

var wsUserManegementType = "WS_UserManagement".ast_TypeReference();

  

var body = aMethod.add_Body(); 

    body.add_Variable("webService", wsUserManegementType.ast_ObjectCreate(),wsUserManegementType);

    var invocation = "webService".ast_Invocation("Login","jv","jv789");

    

    body.add_Variable("result", invocation, "String"); 

    body.add_Invocation("result","info");

    body.add_Invocation("Console","Write","The Login Invocation result is: ");

    body.add_Invocation("Console","WriteLine","result".identifier());

  

    

  

var csharpCode = compilationUnit.csharpCode()

                                .insertAt(0, @"//O2File:E:\O2\O2.Temp\5_10_2013\wsdl_tmpC5E1\WS_UserManagement.cs".line());

  

  

  

var tempFile = csharpCode.saveWithExtension(".cs");

codeEditor.open(tempFile)

          .compileCSSharpFile()

          .executeFirstMethod();

  

          return "ok";

//using ICSharpCode.NRefactory.Ast

//using O2.API.AST.ExtensionMethods.CSharp

//O2File:_Extra_methods_To_Add_to_Main_CodeBase.cs

2) creating the ‘login wrapper/proxy’ method

var compilationUnit = new CompilationUnit();

compilationUnit.add_Using("O2.DotNetWrappers.ExtensionMethods");

compilationUnit.add_Using("System");

  

var file = @"E:\O2\O2.Temp\5_10_2013\wsdl_tmpC5E1\WS_UserManagement.cs";

var loginMethod = file.csharpAst().method("Login");;

var className = loginMethod.Parent.prop("Name").str(); 

  

var aClass  = compilationUnit.add_Type(className + "_Wrapper");

  

var aMethod = aClass.add_Method(loginMethod);    

  

var body = new BlockStatement();

body.add_Variable("webService", 

                  className.ast_TypeReference().ast_ObjectCreate(),

                  className.ast_TypeReference());

var parameters = loginMethod.parameters().names().ast_Identifiers().ToArray();

var invocation = "webService".ast_Invocation("Login",parameters);

var result = body.add_Variable("result", invocation, loginMethod.TypeReference);

body.add_Return(result.Name.ast_Identifier());

  

loginMethod.Body = body;

loginMethod.Attributes = null;

  

  

  

var csharpCode = compilationUnit.csharpCode()

                                .insertAt(0, @"//O2File:{0}".format(file).line());

  

var tempFile = csharpCode.saveWithExtension(".cs");

codeEditor.open(tempFile);

3) creating a test method that with an SQL Injection payload:

var compilationUnit = new CompilationUnit();

compilationUnit.add_Using("O2.DotNetWrappers.ExtensionMethods");

compilationUnit.add_Using("System");

  

var file = @"E:\O2\O2.Temp\5_10_2013\wsdl_tmpC5E1\WS_UserManagement.cs";

var loginMethod = file.csharpAst().method("Login");;

var className = loginMethod.Parent.prop("Name").str(); 

  

var aClass  = compilationUnit.add_Type(className + "_Wrapper");

  

var testBody = aClass.add_Method("testMethod")

                      .setReturnType("void")

                       .add_Body();

                  

var loginPayload = "jv' and 1 = @@version --";                  

var loginInvoke = "Login".ast_Invocation(loginPayload,"jv789"); 

var infoInvoke  = loginInvoke.add_Invocation("info");

testBody.append_AsStatement(infoInvoke); 

      

 

var aMethod = aClass.add_Method(loginMethod);    

  

var body = new BlockStatement();

body.add_Variable("webService", 

                  className.ast_TypeReference().ast_ObjectCreate(),

                  className.ast_TypeReference());

var parameters = loginMethod.parameters().names().ast_Identifiers().ToArray();

var invocation = "webService".ast_Invocation_onType("Login",parameters);

var result = body.add_Variable("result", invocation, loginMethod.TypeReference);

body.add_Return(result.Name.ast_Identifier());

  

loginMethod.Body = body;

loginMethod.Attributes = null;

  

  

  

var csharpCode = compilationUnit.csharpCode()

                                .insertAt(0, @"//O2File:{0}".format(file).line());

  

var tempFile = csharpCode.saveWithExtension(".cs");

codeEditor.open(tempFile);

  

if (true)

    codeEditor.compileCSSharpFile()          

              .executeFirstMethod();

  

          return "ok";

//using ICSharpCode.NRefactory.Ast

//using O2.API.AST.ExtensionMethods.CSharp

//O2File:_Extra_methods_To_Add_to_Main_CodeBase.cs

Dinis Cruz Blog

Pages

Thursday, 16 May 2013

Using AST to programmatically create an Asmx WebServices WebMethod invocation wrapper (for HacmeBank)

Blog Archive

Popular Posts