Netwrix Auditor User Activity Video Recording Remote Code Execution

This repository provides a comprehensive lab and exploit toolkit for CVE-2022-31199, a critical unauthenticated remote code execution vulnerability in Netwrix Auditor (<10.5) via insecure .NET Remoting deserialization. The structure includes: - A vulnerable server simulator (Python and C#/.NET versions) that mimics the Netwrix UAVRServer endpoint on TCP port 9004, with intentionally insecure deserialization settings (TypeFilterLevel=Full). - Exploit scripts in Python (exploit.py, test_exploit.py) and PowerShell (exploit.ps1) that can check for the vulnerability and deliver serialized payloads to achieve RCE. The Python scripts can use payloads generated by ysoserial.net, and the PowerShell script automates the full attack chain. - Dockerfiles and docker-compose files for easy lab deployment on Windows, Linux, and macOS, including both the vulnerable server and an attacker machine. - Detection rules (Snort, YARA) and a Nuclei template for automated detection and scanning. - Documentation and guides for both manual and automated exploitation, including example payloads and post-exploitation steps. The main attack vector is network-based, targeting the .NET Remoting service on TCP port 9004. The exploit achieves SYSTEM-level code execution by sending a malicious serialized object to the UAVRServer endpoint. The repository is well-structured for both educational and practical exploitation, with clear separation between vulnerable server code, exploit tools, detection signatures, and documentation.