3

In Java, using the RMI API, you can execute arbitrary code by sending it to a remote machine to execute. I'm aware something similar but not quite the same can be achieved in .NET using Remoting or WCF.

But from my experience, neither allows arbitrary code execution, the remote machine still needs a reference to the object, not just an interface. Is that correct?

I've gotten around it by having a DLL accessible in a shared location which is updated and the remote machine is able to use that in order to execute code. Is there a better way?

EDIT: http://www.cs.ucsb.edu/~cappello/lectures/rmi/helloworld.shtml In the link, the method call simply returns a string. This could be anything however and the client didn't have prior knowledge of the implementation of the method.

redspidermkv
  • 503
  • 10
  • 25
  • What are you asking? What does "arbitrary code execution" mean? I don't think RMI ships bytecode to the remote computer to execute. Even if it does, that's a *huge* security vulnerability – Panagiotis Kanavos Jun 26 '15 at 11:34
  • I've updated the question with what I mean by arbitrary code. I agree it would be a security issue but it can also be a useful feature if done right – redspidermkv Jun 26 '15 at 11:38

1 Answers1

2

neither allows arbitrary code execution

That is correct, you must expose the code you want to execute remotely.

...the remote machine still needs a reference to the object, not just an interface. Is that correct?

No in the WCF client you can add a reference to the service and local copies of the classes the service uses are created.

Note that Remoting is:

not recommended for new development.

But you can avoid a shared location dll by adding reference to a shared dll from both client and server projects and therfore deploy same dll to both locations.

Or add class source file as link to one project from the other.

Run arbitrary code compiled from string

You can compile and run arbitrary code at runtime and combine this with a simple WFC method that takes a string, compiles and runs it, that would achieve what you want:

Community
  • 1
  • 1
weston
  • 54,145
  • 21
  • 145
  • 203