Proof-of-Concept RCE Exploit for the SheetRat
This repository contains a proof-of-concept tool that demonstrates remote code execution against the administration panel of the SheetRat remote administration tool. The exploit chains a path traversal flaw in the panel's file download handler with a classic DLL search-order hijack of Ionic.Zip.dll, resulting in arbitrary code execution with the privileges of the panel process.
The project is published for security research, incident response, and defensive engineering: it documents a real attack path against RAT panel infrastructure, which is itself a target worth hardening and monitoring.
- Overview
- Vulnerability Summary
- Exploit Chain
- Wire Protocol
- Repository Layout
- Build
- Usage
- Payload Note
- Detection and Mitigation
- Limitations
- Legal Disclaimer
- License
- Contact
The SheetRat panel implements a remote file download feature over its custom TCP protocol. Two independent flaws combine into one exploitation chain:
- Path traversal (CWE-22). The destination file path supplied by the client is used without sanitization or normalization. The value
..\..\..\Ionic.Zip.dllescapes the intended storage directory by three levels and lands in the panel's own application folder. - DLL search-order hijacking (CWE-427).
Ionic.Zip.dllis a third-party assembly that the panel loads from its application directory when performing ZIP operations. It is not part of the .NET Framework and is not resolved from the GAC, so a planted file of that name is loaded automatically.
The result is code execution in the context of the panel process. No user interaction is required: the payload fires the next time the panel performs a ZIP operation during normal operation.
| Property | Value |
|---|---|
| Target | SheetRat RAT administration panel (Windows, .NET Framework 4.8) |
| Weaknesses | CWE-22 (path traversal write), CWE-427 (uncontrolled search path element) |
| Impact | Arbitrary code execution with the privileges of the panel process (commonly elevated) |
| Access required | Network reachability of the panel's TCP port |
| User interaction | None; execution is deferred until the panel's next ZIP operation |
| Exploit complexity | Low: two packets over a plain TCP socket |
The sequence below reflects the actual implementation in Exploit.cs and Program.cs.
- The operator enters the panel address as
IP:port. The tool performs a plain TCP connect to confirm the panel is online and exits if it is not. - The operator selects the path of the DLL file to upload and enters an arbitrary label that appears in the panel's client list under the HWID column.
- The tool sends a
DownloadInfopacket. Its path field carries the traversal payload..\..\..\Ionic.Zip.dll, which instructs the panel to write the incoming file three levels above its working directory, i.e. into its application folder. - The tool sends a
DownloadGetpacket containing the payload file, Base64-encoded, along with the same traversal path. - The panel writes the received bytes to
Ionic.Zip.dllin its application directory. - On the panel's next ZIP operation, the runtime resolves
Ionic.Zip.dllfrom the application directory, loads the planted assembly, and executes its code with the panel's privileges.
The following details are useful for traffic analysis and signature development. All of them are derived from the panel-compatible client implementation in Clients.cs.
Framing. Each message is a UTF-8 text string, GZip-compressed and prefixed with a 4-byte little-endian length field containing the size of the compressed blob.
Field delimiter. Fields inside a message are separated by the literal <@> token.
Commands.
| Command | Field layout | Purpose |
|---|---|---|
DownloadInfo |
DownloadInfo<@>{label}<@>{fileSize}<@>{destinationPath}<@>true |
Announces a file transfer; label is displayed as HWID in the panel |
DownloadGet |
DownloadGet<@>{base64Content}<@>{destinationPath} |
Transfers the file content, Base64-encoded |
Transport behavior. Socket buffers are set to 50 KB. Compressed payloads larger than 1,000,000 bytes are streamed in 500,000-byte chunks; smaller payloads are written in a single call. The client drains pending data and closes the socket after the transfer.
sheetratexploit/
├── sheetratexploit.sln # Visual Studio solution
├── sheetratexploit.csproj # Classic-style project, .NET Framework 4.8, AnyCPU, icon embedded
├── Program.cs # Entry point: interactive prompts and control flow
├── Exploit.cs # Packet construction: DownloadInfo + DownloadGet with traversal path
├── Clients.cs # TCP client: socket setup, GZip framing, chunked send, cleanup
├── Helper.cs # Console UI: connectivity check, banner, colored status output
├── Properties/AssemblyInfo.cs # Assembly metadata
├── App.config # Runtime configuration (v4.8)
├── icon.ico # Application icon
└── .gitignore # Rider/VS artifacts
Requirements: Windows with Visual Studio 2019 or 2022 (or JetBrains Rider) and the .NET Framework 4.8 targeting pack.
Using Visual Studio: open sheetratexploit.sln and build the Release configuration.
Using MSBuild from a Developer Command Prompt:
msbuild sheetratexploit.sln /p:Configuration=ReleaseThe output executable is written to bin\Release\sheetratexploit.exe.
The tool is an interactive console application. Run it and follow three prompts:
[?] Enter IP:port of the Sheet Rat c2.
[?] Enter path to file you want to upload:
[?] Enter any text(will show as HWID in sheet rat):
- Address. Panel host and port, for example
93.184.216.34:8989. The tool first tests plain TCP connectivity; if the host is unreachable it prints[ERROR] Server is offlineand exits. - File path. Full or relative path to the DLL file to upload. If the file does not exist, the tool reports the error and exits.
- Label. Arbitrary text shown in the panel's client list as the HWID value; left empty, it defaults to
exploit.
The console reports each step with colored [INFO], [SUCCESS], and [ERROR] statuses. After the DownloadGet packet is delivered the socket is closed and the tool exits.
The repository does not ship any payload. The uploaded file is whatever the operator supplies at the file path prompt; for the hijack to succeed, the file must be a valid .NET assembly and must be named Ionic.Zip.dll, since the panel resolves that exact file name from its application directory.
For panel developers:
- Treat every client-supplied path as hostile. Resolve it with
Path.GetFullPathand verify that the result stays inside the intended storage root; reject absolute paths and any form of... - Keep application assemblies in a directory writable only by the service account, and load dependencies from that protected location only. Consider strong-naming and strict assembly loading.
- Run the panel under a dedicated low-privilege account instead of SYSTEM or Administrator, so a hijack does not inherit elevated rights.
For defenders and threat hunters:
- Alert on
DownloadInfoorDownloadGettraffic whose path field contains..\or any traversal pattern. - Alert on creation or modification of
Ionic.Zip.dll(or any assembly) outside the panel's install root. - The protocol framing is distinctive: a 4-byte little-endian length followed by a GZip stream containing
<@>-delimited ASCII commands on the panel port is a reliable signature even without payload inspection.
Stated explicitly, since the tool is a minimal proof of concept:
- One target per run. There is no host list handling, no scanning, and no background workers.
- No retry logic. A failed socket operation surfaces as a console error and ends the run.
- Execution is not immediate. The planted DLL loads only when the panel performs a ZIP operation.
- The payload is transferred in a single request, so very large files depend on available memory on both sides.
- The console output is status-only; there is no file logging.
This project is for educational and security research purposes only. The authors are not responsible for any misuse of this tool. Use it only on systems you own or have explicit written permission to test.
By downloading or using this software, you agree to comply with all applicable laws and regulations. The creator assumes no liability for any illegal or unethical use.
Distributed under the MIT License. See LICENSE for the full text.
Author: @whoamicrash. Telegram: @hackerebanatik