AssemblyInstallerLoad
gadget
Loads a DLL you name and runs its [RunInstaller(true)] installers.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g AssemblyInstallerLoad -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | Json.NET, Xaml, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerBinary, SharpSerializerXml, MessagePackTypeless, MessagePackTypelessLz4 | assembly-file | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | Json.NET, Xaml, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerBinary, SharpSerializerXml, MessagePackTypeless, MessagePackTypelessLz4 | unc-path | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: Target-local DLL path (default) (default)
- 2: UNC DLL path (the target fetches it over SMB)
Options (2)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Variant number. It selects what -c must be and what the target has to do to reach the assembly (a .dll or a managed .exe; the sink is Assembly.LoadFrom). Choices: 1 (default) - a path the TARGET can already open, e.g. C:\programdata\installer.dll 2 - a UNC path the target fetches over SMB, e.g. \\attacker\share\installer.dll. The target must be able to reach the share, and .NET only loads an assembly from a share it classifies as Local Intranet; an Internet-zone share (a bare IP is one) needs loadFromRemoteSources=true on the target. The (2) formatter annotation counts these two variants, not the independent --getter choices. Default value: "1". Suggested values: 1, 2. | 1 | false |
getter= | Which WinForms getter-call carrier reads AssemblyInstaller.HelpText. Choices: 1 (default) - PropertyGrid (reads every property once; the only carrier every formatter here can build) 2 - ComboBox (reads HelpText several times; the installers are still built once) 3 - ListBox 4 - CheckedListBox 5 - BindingSource (reads HelpText once; a Component with no window, so it suits a headless target) Only Json.NET and Xaml can build carriers 2 to 4. Carrier 5 works with Xaml, FastJson, JavaScriptSerializer and both SharpSerializer flavours, but not with Json.NET, YamlDotNet or MessagePack. The (2) formatter annotation counts DLL-path variants, not getter choices. Default value: "1". Suggested values: 1, 2, 3, 4, 5. | 1 | false |
Credit: [Finders: Alvaro Munoz, Oleksandr Mirosh, Piotr Bazydlo] [Contributors: Soroush Dalili]