شکار آسیب‌پذیری‌های Deserialization با کمک Claude؛ نگاهی فنی به یک تهدید پیچیده!

				
					from mcp.server.fastmcp import FastMCP
import subprocess
import os

server = FastMCP("ilspy docker")

@server.prompt()
def setup_prompt() -> str:
    return """
    You can use the following commands to decompile .NET assemblies, using ilspy:
    - decompile(file: str, output_folder: str) -> int: Decompile the file at the provided path. 
    The returned value is the success code, with 0 indicating a successful run
    """

@server.tool()
def run_ilspycmd_docker(exe_path, output_folder) -> int:
    """
    Run ilspycmd in a Docker container to decompile a DLL
    
    Args:
        dll_path (str): Path to the DLL file to decompile
        output_folder (str): Folder where decompiled code will be placed
    
    Returns:
        tuple: (return_code, stdout, stderr)
    """
    # Get absolute paths
    input_dir = os.path.abspath(os.path.dirname(exe_path))
    output_dir = os.path.abspath(output_folder)
    exe_filename = os.path.basename(exe_path)
    
    # Ensure output directory exists
    os.makedirs(output_dir, exist_ok=True)
    
    # Create input directory inside container
    container_input_dir = "/decompile_in"
    container_output_dir = "/decompile_out"
    
    ilspy_cmd_path = "/home/ilspy/.dotnet/tools/ilspycmd"
    ilspy_command = f"{ilspy_cmd_path} -p -o {container_output_dir} {container_input_dir}/{exe_filename}"
    
    # Build the Docker command
    docker_cmd = [
        "docker", "run", "--rm",
        "-v", f"{input_dir}:{container_input_dir}",
        "-v", f"{output_dir}:{container_output_dir}",
        "ilspycmd", 
        ilspy_command 
    ]
    
    # Run the command
    process = subprocess.run(
        docker_cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True
    )
    return process.returncode

if __name__ == "__main__":
    # Initialize and run the server
    server.run(transport='stdio')