ActivitySurrogateSelector
gadget
This gadget ignores the command parameter and executes the constructor of the bundled ExploitClass class. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3; ysonet compiles the bundled ExploitClass.cs with the CLR-v2 compiler and writes Func delegates against System.Core 3.5. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g ActivitySurrogateSelector -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, SoapFormatter, LosFormatter | none | built-in, net-framework | net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, SoapFormatter, LosFormatter | none | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 3 | BinaryFormatter, SoapFormatter, LosFormatter | none | built-in, net-framework | net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: new enumerator chain (version-compatible, default) (default)
- 2: old chain (shorter, may not work across versions)
- 3: DataSet root carrier (larger compatibility alternative)
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Payload variant number where applicable. Choices: 1 (default), 2 (shorter but may not work between versions), 3 (larger DataSet carrier) Default value: "1". Suggested values: 1, 2, 3. | 1 | false |
Credit: [Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]