Collected research

.NET Remoting Revisited

Markus Wulftange · Code White

.NET Remoting publishes objects over HTTP, named pipes and TCP and deserialises client messages with BinaryFormatter or SoapFormatter. The post shows its security options failing, and how an ObjRef reference, a forged Hashtable comparer or a lease sponsor makes a server deserialise attacker data or call back to an attacker host for code execution.

Record

Researcher

Markus Wulftange

Published by

Code White

Topic

Other

In the archive

• Collected in the 2022 research round

Related sources

• ObjRef gadget implementation
• Rogue remoting server
• Enhanced exploitation tool

Tags

• deserialization
• gadget-chain
• rce
• dotnet
• toctou
• auth-bypass
• tooling
• owasp-a01-2021
• owasp-a04-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Markus Wulftange, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 28 August 2026.