Module catalog

Declarations from v2026.9.2. These are not measured runtime results. About this data.

76 modules

gadget

ActivitySurrogateDisableTypeCheck

Disables 4.8+ type protections for ActivitySurrogateSelector, command is ignored. Variant 1 also takes rootcontainer (1 SortedSet, 2 SortedDictionary, 3 TreeSet) to dodge a SortedSet wire-name blocklist; SoapFormatter supports roots 1 and 3. Variant 1 self-tests in a child, then keeps the setting enabled in this session.

BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormattergadget

ActivitySurrogateSelector

This gadget ignores the command parameter and executes the constructor of the bundled ExploitClass class. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3; ysonet compiles the bundled ExploitClass.cs with the CLR-v2 compiler and writes Func delegates against System.Core 3.5. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.

BinaryFormatter, SoapFormatter, LosFormattergadget

ActivitySurrogateSelectorFromFile

Another variant of the ActivitySurrogateSelector gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Put a semicolon before its references and separate multiple references with commas, e.g., '-c MyClass.cs;UsedRef.dll,Ref2.dll'. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.

BinaryFormatter, SoapFormatter, LosFormattergadget

AssemblyCatalogLoad

MEF AssemblyCatalog(codeBase) opens -c and loads it as an assembly. A UNC path also starts an SMB session, which sends authentication material. The load alone runs no code.

Xamlgadget

AssemblyInstallerLoad

Loads a DLL you name and runs its [RunInstaller(true)] installers.

Json.NET, Xaml, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerBinary, SharpSerializerXml, MessagePackTypeless, MessagePackTypelessLz4gadget

AxHostState

BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializergadget

BaseActivationFactory

Gadget for .NET 5/6/7 with WPF enabled or Microsoft.WindowsDesktop.App\PresentationFramework.dll available. Leads to remote DLL loading (native C/C++ DLL)

Json.NETgadget

BootstrapperBuilder

Setting Path makes the target read <your path>\Engine and \Packages. Any UNC path opens an SMB session to that host. A setup.xml you leave there is parsed with legacy XML defaults.

Json.NET, JavaScriptSerializer, FastJson, YamlDotNet, Xaml, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4, DataContractJsonSerializer, DataContractSerializer, NetDataContractSerializergadget

ClaimsIdentity

BinaryFormatter, SoapFormatter, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, LosFormattergadget

ClaimsPrincipal

BinaryFormatter, SoapFormatter, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, LosFormattergadget

ColorConvertedBitmapExtension

One XAML document makes the target request three URIs it names: image, source ICC profile, destination ICC profile. The profiles must return valid profiles. Remote image/profile loading is documented WPF behaviour, so this is a shape, not a new bug.

Xamlgadget

DataSet

BinaryFormatter, SoapFormatter, LosFormattergadget

DataSetOldBehaviour

This gadget targets an old behavior of DataSet which uses XML format

BinaryFormatter, LosFormattergadget

DataSetOldBehaviourFromFile

Another variant of the DataSetOldBehaviour gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'

BinaryFormatter, LosFormattergadget

DataSetTypeSpoof

A more advanced type spoofing that can use any arbitrary types can be seen in TestingArenaHome::SpoofByBinaryFormatterJson or in the DataSetOldBehaviour gadget

BinaryFormatter, SoapFormatter, LosFormattergadget

DataSetXxe

Sets the DataSet XmlSchema member so the target's legacy XmlTextReader resolves an external entity. Variant 1 fetches your URL; variant 2 reads a target file back to you. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no <httpRuntime targetFramework> is legacy even on a fully patched 4.8.1 machine.

BinaryFormatter, SoapFormatter, LosFormatter, Json.NET, FsPicklergadget

DataTable

Same-graph System.Data.DataTable root carrier: the inner TextFormattingRunProperties gadget travels in an object column and is deserialized by the same outer formatter. A standalone DataTable stores its rows inline in its own SerializationInfo (DataTable_N.Records), so unlike the DataSet gadget it opens no nested BinaryFormatter and no new binder boundary (verified against the System.Data source). Useful when a target requires or casts the deserialized root object to DataTable, for example SharePoint's ExcelDataSet.CompressedDataTable. Microsoft treats deserializing a DataTable with an unsafe formatter as a full remote code execution risk (CA2362, DataSet/DataTable security guidance). The inner gadget is selectable with var/variant: 1 (default) TextFormattingRunProperties, which needs the Microsoft.PowerShell.Editor assembly and WPF and supports BinaryFormatter, SoapFormatter and LosFormatter; 2 TypeConfuseDelegate, a framework built-in that needs no WPF or Microsoft.PowerShell.Editor and supports BinaryFormatter, SoapFormatter and LosFormatter. Its SOAP form uses generation-only aliases but presents the native CLR4 TCD graph to the target. Forshaw's 'Are You My Type?' (Black Hat 2012) documents the related but distinct DataSet nested-BinaryFormatter bridge.

BinaryFormatter, SoapFormatter, LosFormattergadget

DataTableTypeSpoof

The DataTable carrier written under the name of a REAL DataTable subclass, so a target that rejects System.Data.DataTable by name still rebuilds it through the inherited serialization constructor; this is not the ', x=]' binder-parse trick DataSetTypeSpoof uses, and it is the same idea watchTowr used on DataSet subclasses for CVE-2025-23120. Default profile: the in-box System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection (assembly System.Data.Entity.Design, part of the full .NET Framework); --target-type and --target-assembly write any name verbatim, for the second in-box profile RelationshipDetailsCollection or a subclass from the target's own assemblies.

BinaryFormatter, SoapFormatter, LosFormattergadget

DataViewManagerXxe

Sets DataViewSettingCollectionString so the target's legacy XmlTextReader fetches an external DTD. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no <httpRuntime targetFramework> is legacy even on a fully patched 4.8.1 machine.

Xaml, JavaScriptSerializer, FastJson, SharpSerializerXml, SharpSerializerBinarygadget

DynamicUpdateMapExtension

DynamicUpdateMapExtension is a public MarkupExtension whose XmlContent hands an x:XData section to NetDataContractSerializer.ReadObject with no binder, so a XAML-only sink carries any NDCS gadget. Needs System.Activities on the target.

Xamlgadget

FileLogTraceListener

Microsoft.VisualBasic.Logging.FileLogTraceListener creates the supplied directory through CustomLocation. With elevated privileges, directory creation in sensitive locations may cause denial of service. On .NET Framework 3.5 both JavaScriptSerializer and DataContractJsonSerializer reach it with --legacyfx (Microsoft.VisualBasic is 8.0.0.0 there, not 10.0.0.0); DataContractJsonSerializer additionally needs a consumer whose root type is that same identity.

Json.NET, FastJson, JavaScriptSerializer, YamlDotNet, MessagePackTypeless, MessagePackTypelessLz4, SharpSerializerXml, DataContractJsonSerializer, Xamlgadget

FileSystemInfo

Normalizes your path on the target. A UNC path with a short-name (~) component makes it reach that host over SMB.

BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializer, DataContractJsonSerializer, Json.NETgadget

FileSystemInfoTimeSetter

Sets a timestamp on the path you give, on the target. Any UNC path opens an SMB session to that host - no short name needed.

Xamlgadget

FileSystemProxyCurrentDirectory

Sets the target process working directory, so every later relative path in it resolves where you chose. Not code execution on its own.

Json.NET, NetDataContractSerializer, DataContractSerializer, DataContractJsonSerializer, MessagePackTypeless, MessagePackTypelessLz4gadget

FormsIdentity

System.Web.Security.FormsIdentity (System.Web, built-in) inherits ClaimsIdentity; sets the inherited ClaimsIdentity+m_serializedClaims field, which the OnDeserialized callback base64-decodes and runs through a nested BinaryFormatter. Alternate root type for the ClaimsIdentity nested-BinaryFormatter sink.

BinaryFormatter, SoapFormatter, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, LosFormattergadget

GenericIdentity

System.Security.Principal.GenericIdentity (mscorlib, built-in) inherits ClaimsIdentity; sets the inherited ClaimsIdentity+m_serializedClaims field, which the OnDeserialized callback base64-decodes and runs through a nested BinaryFormatter. Alternate root type name for the ClaimsIdentity nested-BinaryFormatter sink.

BinaryFormatter, SoapFormatter, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, LosFormattergadget

GenericPrincipal

BinaryFormatter, SoapFormatter, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, LosFormattergadget

GetterCompilerResults

Remote DLL loading gadget for .NET 5/6/7 with WPF enabled (mixed DLL). Local DLL loading for .NET Framework if System.CodeDom is available. DLL path delivered with -c argument

Json.NETgadget

GetterSecurityException

Json.NETgadget

GetterSettingsPropertyValue

Json.NET, Xaml, MessagePackTypeless, MessagePackTypelessLz4gadget

HashPEFileHandle

CLR v2 adopts -c as a native PE-file handle in System.Security.Policy.Hash, which may later crash or corrupt the target process when native code consumes or releases it. .NET 4 removed the branch. No code execution or memory read/write is proved.

BinaryFormatter, LosFormattergadget

InfiniteProgressPage

Microsoft.ApplicationId.Framework.InfiniteProgressPage loads the supplied HTTP, HTTPS, FTP, or file URL through AnimatedPictureFile. This can trigger SSRF or NTLM authentication. The target needs Microsoft.ApplicationId.Framework.

Json.NET, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerXml, Xamlgadget

ObjectDataProvider

Reaching a .NET Framework 3.5 target needs --legacyfx, which rewrites the PresentationFramework identity to 3.0.0.0. Measured there on XmlSerializer and JavaScriptSerializer; DataContractSerializer binds every assembly and still fails to build the projected property on the 3.0 reader. The two MessagePack Typeless cells depend on the target's MessagePack version: MessagePack carries its own hardcoded deny list, and System.Windows.Data.ObjectDataProvider joined it in 2.5.205 and in 3.1.5. Below those (2.5.198 and 3.1.4 and older, which is every release the technique was published against) the list held only TempFileCollection and IWbemClassObjectFreeThreaded and the payload fires; on 2.5.205+ or 3.1.5+ the reader refuses it by name and nothing runs.

Xaml, Json.NET, FastJson, JavaScriptSerializer, XmlSerializer, DataContractSerializer, YamlDotNet, FsPickler, SharpSerializerBinary, SharpSerializerXml, MessagePackTypeless, MessagePackTypelessLz4gadget

ObjRef

BinaryFormatter, SoapFormatter, LosFormattergadget

PictureBox

System.Windows.Forms.PictureBox loads the supplied HTTP, HTTPS, FTP, or file URL through ImageLocation. This can trigger SSRF or NTLM authentication.

Json.NET, FastJson, JavaScriptSerializer, YamlDotNet, MessagePackTypeless, MessagePackTypelessLz4, SharpSerializerXml, Xamlgadget

PSObject

Target must run on a system not patched for CVE-2017-8565 (Published: 07/11/2017)

BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormattergadget

ResourceDictionary

ResourceDictionary.Source makes the target fetch -c and load it as WPF markup. A UNC path instead coerces an SMB session, which sends authentication material.

Xamlgadget

ResourceSet

BinaryFormatter, NetDataContractSerializer, LosFormattergadget

ResXFileRef

Runs the ResXFileRef type converter on the target, which opens the -c path (a UNC path works) and builds the type named in the payload. The type name decides the effect, so pick the variant that matches what you want.

Xaml, YamlDotNetgadget

RolePrincipal

BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormattergadget

SessionSecurityToken

BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormattergadget

SessionViewStateHistoryItem

BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter, Json.NET, DataContractSerializergadget

TempFileCollection

Targets the [Serializable] TempFileCollection in the .NET Framework's in-box System.dll, not the NuGet copy. It deletes target paths on dispose/finalize; -t DELETES them HERE. Below 4.0 strict readers need --legacyfx.

BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializergadget

TextFormattingRunProperties

This normally generates the shortest payload

BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter, DataContractSerializer, Json.NETgadget

ToolboxItemContainer

BinaryFormatter, LosFormatter, SoapFormattergadget

TypeConfuseDelegate

Combines a Comparison<string> with itself, wraps it with Comparer<string>.Create, then swaps invocation-list slot 1 for Process.Start(string, string). The sorted container calls the comparer while rebuilding on deserialize, and the confused return type runs the command. The var/variant option picks the serialized root container: 1 (default) SortedSet<string>; 2 SortedDictionary<string,string>, whose serialized TreeSet<KeyValuePair<string,string>> backing set forwards key comparisons through SortedDictionary.KeyValuePairComparer; 3 the internal System.Collections.Generic.TreeSet<string>, built by reflection. Variants 2 and 3 exist for one narrow case: a binder or blocklist that rejects the exact wire type name System.Collections.Generic.SortedSet but allows the other roots. They do not defeat an allowlist, a rule that also names TreeSet, or a policy that resolves types and rejects SortedSet subclasses (TreeSet derives from SortedSet). Variants 2 and 3 refuse an input whose executable and argument strings compare equal, because both roots reject a duplicate key; variant 1 accepts it but its SortedSet then holds one element and does not fire, so make the two strings differ. SoapFormatter is a direct CLR4 document for variants 1 and 3: the target sees the native SortedSet<string> or TreeSet<string> root and ComparisonComparer<string>, with no Workflow surrogate, outer carrier, or nested BinaryFormatter stream. Variant 2 does not support SoapFormatter. All three variants target .NET Framework 4.5+; use TypeConfuseDelegateNetFx40 for exactly .NET Framework 4.0 or TypeConfuseDelegateNetFx35 for .NET Framework 3.5 / CLR2. --legacyfx is not supported because rewriting assembly versions cannot turn this Comparer<T>.Create graph into a CLR2 graph.

BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormattergadget

TypeConfuseDelegateFileOperations

Performs a file operation on the target through the TypeConfuseDelegate delegate confusion, without starting a process: write text from a local file, copy, move, move a directory, or create/truncate an empty file. The var/variant option picks the operation and decides what -c means; the two strings only have to DIFFER, in either order. This CLR4.5+ graph does not support --legacyfx.

BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormattergadget

TypeConfuseDelegateMono

Tweaked TypeConfuseDelegate gadget to work with Mono; --legacyfx is not supported because that option targets .NET Framework CLR2.

BinaryFormatter, NetDataContractSerializer, LosFormattergadget

TypeConfuseDelegateNetFx35

CLR2-only: supports .NET Framework 3.5 and does not support CLR4 or later. Runs Process.Start(string, string) by rebuilding CLR 2's Array.FunctorComparer<string> through Workflow ObjectSerializedRef and triggering it from TreeSet<string>. The SOAP form is a direct List<object>/TreeSet<string> document: only the internal comparer reconstruction uses ObjectSerializedRef, with no outer surrogate carrier or nested BinaryFormatter stream. The payload names CLR-v2 framework identities automatically; an explicit --legacyfx is redundant. The target needs System.Core 3.5 and System.Workflow.ComponentModel. NetDataContractSerializer is not supported: its CLR-2 reader rejects the graph because ObjectSerializedRef's required memberDatas member is missing. On .NET Framework 4.8.1 the Workflow object reference rejects this CLR-2 reconstruction with ArgumentException before the sink. A local --test is therefore routed automatically to the separately shipped .NET Framework 3.5 / CLR2 process; --testclr2 selects it explicitly.

BinaryFormatter, SoapFormatter, LosFormattergadget

TypeConfuseDelegateNetFx40

.NET Framework 4.0-only: reconstructs that runtime's non-serializable Array.FunctorComparer<string> through Workflow ObjectSerializedRef, preloads it before a SortedSet<string> in List<object>, and lets the set call the confused String.Compare/Process.Start delegate while rebuilding. The target needs System.Workflow.ComponentModel. BinaryFormatter, SoapFormatter and LosFormatter are supported; the SOAP form is a direct List<object>/SortedSet<string> document with no outer carrier or nested BinaryFormatter stream. NetDataContractSerializer cannot reproduce the required memberDatas contract. Later CLR 4 builds use an incompatible private comparer shape, so local -t is refused; --legacyfx is also invalid because this graph requires CLR4 identities. When to use it: only when the target's INSTALLED framework is genuinely 4.0 (4.5+ never installed). .NET 4.5+ replaces 4.0 in place, so on any 4.5 to 4.8 target use TypeConfuseDelegate instead. That includes a 'v4.0' IIS app pool, which selects CLR 4, not .NET 4.0, and a web.config targetFramework of 4.0, which only sets compatibility quirks. Decide by the installed framework, not the app pool label: if HKLM ...NDP\v4\Full has a 'Release' value it is 4.5+, and absent means genuine 4.0. How to test it: run ysonet.Net40TestHost.exe --probe on the target (shape=netfx40 confirms genuine 4.0), then its --deserialize fires the payload; a Windows image with 4.0 and no 4.5+ update, or an isolated 4.0 VM, is a suitable victim.

BinaryFormatter, SoapFormatter, LosFormattergadget

TypeConfuseDelegatePowerShell

Requires Microsoft.PowerShell.Commands.Utility, Version=3.0.0.0 on the target and the application setting microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck=true. That setting is mandatory on current serviced .NET Framework and cannot be armed by another object in the same graph before Workflow resolves the comparer. The measured target is .NET Framework 4.8.1; older Framework versions are not claimed. The graph needs two distinct command fields, so a one-part --rawcmd value is refused. Local --test runs only when Workflow's effective setting is already true in this process.

BinaryFormatter, LosFormattergadget

WbemClassObjectUnmarshal

Feeds a serialized byte[] to native CoUnmarshalInterface. Variant 1 calls out to your host on RPC 135; variant 2 ships a blob you built.

BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializer, Json.NET, FsPicklergadget

WindowsClaimsIdentity

Requires Microsoft.IdentityModel.Claims namespace (not default GAC)

BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormattergadget

WindowsIdentity

The variant picks which ClaimsIdentity key carries the inner BinaryFormatter payload.

BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormattergadget

WindowsPrincipal

BinaryFormatter, Json.NET, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, SoapFormatter, LosFormattergadget

WorkflowDesigner

PropertyInspectorFontAndColorData is a write-only string whose setter runs XamlReader.Load on it (XmlResolver is null, so no XXE). The target needs System.Activities.Presentation and an STA thread.

Json.NET, Xaml, FastJson, JavaScriptSerializer, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4gadget

WSManPluginInstance

Builds a Windows PowerShell type whose finalizer terminates the target process. The effect is asynchronous and needs System.Management.Automation.

BinaryFormatter, SoapFormatter, LosFormatter, Json.NET, Xaml, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, XmlSerializergadget

XamlAssemblyLoadFromFile

Loads assembly using XAML. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'. Variant 1 also takes rootcontainer (1 SortedSet, 2 SortedDictionary, 3 TreeSet) to dodge a SortedSet wire-name blocklist; SoapFormatter supports roots 1 and 3. It self-tests in a child process.

BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormattergadget

XamlImageInfo

Gadget leads to XAML deserialization. Variant 1 (GAC) reads XAML from file (local path or UNC path can be given). Variant 2 (non-GAC) delivers XAML directly, but requires Microsoft.Web.Deployment.dll

Json.NETgadget

XamlTypeConverterFetch

One ordinary XAML attribute makes the target fetch -c through a [TypeConverter]. No ObjectDataProvider and no constructor. Remote image loading is documented WPF behaviour, so this is a shape, not a new bug.

Xaml, Json.NET, JavaScriptSerializer, YamlDotNetgadget

XmlDocumentSurrogateXxe

A [Serializable] IObjectReference carrier in System.Workflow.ComponentModel whose GetRealObject sets XmlDocument.InnerXml, so the target parses your XML. Variant 1 makes the target fetch your URL; variant 2 reads a target file back to you. No surrogate selector has to be registered. Needs System.Workflow.ComponentModel. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no <httpRuntime targetFramework> is legacy even on a fully patched 4.8.1 machine.

BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializer, DataContractJsonSerializer, FsPicklergadget

XmlDocumentXxe

Sets XmlDocument.InnerXml, so the target parses your XML and fetches an external DTD. Variant 1 needs a target app on pre-4.5.2 XML resolver defaults, a machine with the EnableLegacyXmlSettings switch back on, or an app that declares NO target framework moniker at all - an ASP.NET app with no <httpRuntime targetFramework> is legacy even on a fully patched 4.8.1 machine. Variant 2 also sets XmlDocument.XmlResolver, which removes that gate entirely.

Xaml, JavaScriptSerializer, FastJson, YamlDotNet, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4plugin

ActivatorUrl

Sends a generated payload to an activated, presumably remote, object

Formatter metadata not declaredplugin

Altserialization

Generates payload for HttpStaticObjectsCollection or SessionStateItemCollection

Formatter metadata not declaredplugin

ApplicationTrust

Generates XML payload for the ApplicationTrust class

Formatter metadata not declaredplugin

Clipboard

Generates payload for DataObject and copies it into the clipboard - ready to be pasted in affected apps

Formatter metadata not declaredplugin

DotNetNuke

Generates payload for DotNetNuke CVE-2017-9822

Formatter metadata not declaredplugin

GetterCallGadgets

Implements arbitrary getter call gadgets for .NET Framework and .NET 5/6/7 with WPF enabled, run with -l for more help

Formatter metadata not declaredplugin

MachineKeySessionSecurityTokenHandler

Generates XML payload for the MachineKeySessionSecurityTokenHandler class

Formatter metadata not declaredplugin

Resx

Generates RESX and .RESOURCES files

Formatter metadata not declaredplugin

SessionSecurityTokenHandler

Generates XML payload for the SessionSecurityTokenHandler class

Formatter metadata not declaredplugin

SharePoint

Generates payloads for the following SharePoint CVEs: CVE-2026-50522, CVE-2025-53770, CVE-2025-49704, CVE-2024-38018, CVE-2020-1147, CVE-2019-0604, CVE-2018-8421

Formatter metadata not declaredplugin

ThirdPartyGadgets

Implements gadgets for 3rd Party Libraries

Formatter metadata not declaredplugin

TransactionManagerReenlist

Generates payload for the TransactionManager.Reenlist method

Formatter metadata not declaredplugin

ViewState

Generates a ViewState using known MachineKey parameters

Formatter metadata not declaredplugin

Xps

Generates a malicious XPS document (CVE-2020-0605) for XpsDocument or PrintQueue.AddJob(path) - binary output, use --outputpath to save it as an .xps file

Formatter metadata not declared