BootstrapperBuilder

gadget

Setting Path makes the target read <your path>\Engine and \Packages. Any UNC path opens an SMB session to that host. A setup.xml you leave there is parsed with legacy XML defaults.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g BootstrapperBuilder -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
Default	Json.NET, JavaScriptSerializer, FastJson, YamlDotNet, Xaml, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4, DataContractJsonSerializer, DataContractSerializer, NetDataContractSerializer	target-path, unc-path	built-in, net-framework	net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1

Options (1)

Option Help Default Required

Option	Help	Default	Required
`rawinput`	Put -c into the payload template exactly as typed, instead of escaping it for the selected formatter. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against. WHAT TO PUT IN -c. Any path the target's file system accepts. The target reads <your path>\Engine and <your path>\Packages, so a bare UNC host works: \attacker.example.com which the target opens as \attacker.example.com\Engine. Nothing has to exist on the far end: a missing directory still costs the target the connect. THE SECOND, CONDITIONAL LEG. For each subdirectory of <your path>\Engine the target also XML-parses <sub>\setup.xml if one is there, with the legacy reader defaults - so an external entity in it is resolved on a target application stamped below 4.5.2. That needs you to control the content on the far end of the path as well, so it is not something this payload delivers on its own and no disclosure is claimed for it. -t IS ACCEPTED and it deserializes the payload HERE, so THIS machine reads the path you named. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. An unreachable UNC host makes -t block until the SMB connect times out. WHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint. Default value: "false".	false	false

rawinput

Put -c into the payload template exactly as typed, instead of escaping it for the selected formatter. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against.

WHAT TO PUT IN -c. Any path the target's file system accepts. The target reads <your path>\Engine and <your path>\Packages, so a bare UNC host works: \attacker.example.com which the target opens as \attacker.example.com\Engine. Nothing has to exist on the far end: a missing directory still costs the target the connect.

THE SECOND, CONDITIONAL LEG. For each subdirectory of <your path>\Engine the target also XML-parses <sub>\setup.xml if one is there, with the legacy reader defaults - so an external entity in it is resolved on a target application stamped below 4.5.2. That needs you to control the content on the far end of the path as well, so it is not something this payload delivers on its own and no disclosure is claimed for it.

-t IS ACCEPTED and it deserializes the payload HERE, so THIS machine reads the path you named. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. An unreachable UNC host makes -t block until the SMB connect times out.

WHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint. Default value: "false".

false

Credit: [Finders: Soroush Dalili]

All modules · Full catalog JSON