Add README and requirements.

CVE-2019-18935.py

@@ -104,7 +104,7 @@ def deserialize():
     print('\n[*] Response time:', round(end - start, 2), 'seconds', file=stderr)
 
 if __name__ == '__main__':
-    parser = ArgumentParser(description='Exploit for CVE-2019-18935, a JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX.')
+    parser = ArgumentParser(description='Exploit for CVE-2019-18935, a .NET deserialization vulnerability in Telerik UI for ASP.NET AJAX.')
     parser.add_argument('-t', dest='test_upload', action='store_true', help="just test file upload, don't exploit deserialization vuln")
     parser.add_argument('-v', dest='version', required=True, help='software version')
     parser.add_argument('-p', dest='payload', required=True, help='mixed mode assembly DLL')

README.md

@@ -0,0 +1,34 @@
+
+## Install
+```bash
+git clone https://github.com/noperator/CVE-2019-18935.git && cd CVE-2019-18935
+python3 -m venv env
+source env/bin/activate
+pip3 install -r requirements.txt
+```
+
+### Requirements
+
+This exploit leverages encryption logic from [RAU_crypto](https://github.com/bao7uo/RAU_crypto). The `RAUCipher` class within `RAU_crypto.py` depends on PyCryptodome, a drop-in [replacement](https://blog.sqreen.com/stop-using-pycrypto-use-pycryptodome/) for the [dead](https://github.com/dlitz/pycrypto/issues/238) PyCrypto module. PyCryptodome and PyCrypto create problems when installed in the same environment, so the best way to satisfy this dependency is to install the module within a virtual environment, as shown above.
+
+## Usage
+
+```
+python3 CVE-2019-18935.py -h
+usage: CVE-2019-18935.py [-h] [-t] -v VERSION -p PAYLOAD -f FOLDER -u URL
+
+Exploit for CVE-2019-18935, a .NET deserialization vulnerability in Telerik UI
+for ASP.NET AJAX.
+
+optional arguments:
+  -h, --help  show this help message and exit
+  -t          just test file upload, don't exploit deserialization vuln
+  -v VERSION  software version
+  -p PAYLOAD  mixed mode assembly DLL
+  -f FOLDER   destination folder on target
+  -u URL      https://<HOST>/Telerik.Web.UI.WebResource.axd?type=rau
+```
+
+## Thanks
+
+[@mwulftange](https://twitter.com/mwulftange) initially [discovered](https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html) this vulnerability. [@bao7uo](https://github.com/bao7uo) wrote all of the logic for [breaking RadAsyncUpload encryption](https://github.com/bao7uo/RAU_crypto), which enabled manipulating the file upload configuration object in `rauPostData` and subsequently exploiting insecure deserialization of that object.

requirements.txt

@@ -0,0 +1,2 @@
+pycryptodome
+requests