SOAPwn Pwning .NET Framework Applications Through HTTP Clien...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/
• Blog Title: SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL
• Suggested Section: network-services-pentesting/pentesting-web/dotnet-or-iis-specific-tricks (new .NET SOAP/WSDL client exploitation page under Pentesting Web or under 80,443 - Pentesting Web Methodology -> .NET/ASP.NET)

🎯 Content Summary

This blog summarizes the Black Hat Europe 2025 research “SOAPwn: Pwning .NET Framework Applications Through HTTP Client Proxies and WSDL”, showing how a long‑standing design flaw in .NET Framework HTTP client proxies becomes a powerful primitive for NTLM credential abuse, arbitrary file writes, and practical RCE in multiple real‑world products (Barracuda Service Center RMM – CVE‑2025‑34392, Ivanti Endpoint Manager – CVE‑2025‑13659, Umbraco 8 CMS, Microsoft PowerShell, Microsoft SSIS).

🔧 Technical Details

Trick 1 – Abusing HttpWebClientProtocol’s Scheme‑Agnostic WebRequest
.NET’s HttpWebClientProtocol.GetWebRequest calls WebRequest.Create(uri) and then performs webRequest as HttpWebRequest, but returns the original webRequest regardless of whether the cast succeeds. Because WebRequest.Create dispatches by URI scheme, any HttpWebClientProtocol‑derived proxy (SoapHttpClientProtocol, DiscoveryClientProtocol, etc.) will use FileWebRequest, FtpWebRequest, or SMB/UNC handlers whenever its Url is file://, ftp://, or file://<UNC>. For SOAP proxies, this means POST bodies (SOAP envelopes) are written directly to files instead of being sent via HTTP, or to SMB shares, enabling file write and NTLM credential exposure primitives.

Trick 2 – NTLM Relaying / Challenge Capture via UNC URL...

🤖 Agent Actions

Summary:

• Added the new “.NET SOAP/WSDL Client Proxy Abuse” page under pentesting-web, detailing the HttpWebClientProtocol design flaw, NTLM relay and file-write primitives, WSDL-driven proxy generation, exploitation workflow, hunting guidance, and mitigations sourced from the watchTowr research.
• Linked the new page from the Pentesting Web Methodology README using a {{#ref}} block so the technique is discoverable alongside other tech-specific guidance.

Tests: Not run (docs-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/

Content Categories: Based on the analysis, this content was categorized under "network-services-pentesting/pentesting-web/dotnet-or-iis-specific-tricks (new .NET SOAP/WSDL client exploitation page under Pentesting Web or under 80,443 - Pentesting Web Methodology -> .NET/ASP.NET)".

Repository Maintenance:

• MD Files Formatting: 916 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge