Skip to content
YSoNet

ActivitySurrogateSelectorFromFile

gadget

Another variant of the ActivitySurrogateSelector gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Put a semicolon before its references and separate multiple references with commas, e.g., '-c MyClass.cs;UsedRef.dll,Ref2.dll'. For a .NET Framework 3.5 target, use --legacyfx with the default variant or variant 3. Variant 2 remains 4.x-only; variant 3 selects the larger DataSet carrier.

Declared metadata, not a runtime result. How to read evidence.

Terminal window
.\ysonet.exe -g ActivitySurrogateSelectorFromFile -h

Target declarations

VariantFormattersInputsRequirementsRuntime tokens
1BinaryFormatter, SoapFormatter, LosFormattersource-code-filebuilt-in, net-frameworknet-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
2BinaryFormatter, SoapFormatter, LosFormattersource-code-filebuilt-in, net-frameworknet-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
3BinaryFormatter, SoapFormatter, LosFormattersource-code-filebuilt-in, net-frameworknet-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
Variants
  • 1: new enumerator chain (version-compatible, default) (default)
  • 2: old chain (shorter, may not work across versions)
  • 3: DataSet root carrier (larger compatibility alternative)
Options (1)
OptionHelpDefaultRequired
var|variant=Payload variant number where applicable. Choices: 1 (default), 2 (shorter but may not work between versions), 3 (larger DataSet carrier) Default value: "1". Suggested values: 1, 2, 3.1false

Credit: [Finders: James Forshaw] [Contributors: Alvaro Munoz, zcgonvh]

All modules · Full catalog JSON