ColorConvertedBitmapExtension

gadget

One XAML document makes the target request three URIs it names: image, source ICC profile, destination ICC profile. The profiles must return valid profiles. Remote image/profile loading is documented WPF behaviour, so this is a shape, not a new bug.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g ColorConvertedBitmapExtension -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
Default	Xaml	remote-url	built-in, wpf, net-framework, modern-dotnet	net-fx-4.8.1, net-10.0

Options (3)

Option Help Default Required

source-profile= REQUIRED. The URI of the source ICC colour profile the target requests. It MUST answer with a valid ICC/ICM profile: WPF's ColorContext parses it, and a parse failure throws before the destination and image requests happen. --source-profile http://attacker.example.com/source.icc Required. Not declared true

destination-profile= REQUIRED. The URI of the destination ICC colour profile the target requests. Same rule as the source profile: it must answer with a valid profile. --destination-profile http://attacker.example.com/destination.icc Required. Not declared true

Option	Help	Default	Required
`source-profile=`	REQUIRED. The URI of the source ICC colour profile the target requests. It MUST answer with a valid ICC/ICM profile: WPF's ColorContext parses it, and a parse failure throws before the destination and image requests happen. --source-profile http://attacker.example.com/source.icc Required.	Not declared	true
`destination-profile=`	REQUIRED. The URI of the destination ICC colour profile the target requests. Same rule as the source profile: it must answer with a valid profile. --destination-profile http://attacker.example.com/destination.icc Required.	Not declared	true
`rawinput`	Put the three URIs into the payload template exactly as typed, instead of escaping them for XML element text. Use this only when you have already escaped the values yourself. It also turns off the check that the finished payload still carries each URI as its own token, because there is then no text of yours left to compare against. WHAT TO PUT IN. Three absolute URIs the target's WebRequest stack accepts, one per input: -c the image, e.g. http://h/i?a=b&c=d --source-profile the source ICC profile --destination-profile the destination ICC profile None of the three may contain a SPACE: the target's constructor splits the one argument on the space character, so a space would break the triple. A query string is fine. WHAT THE TARGET DOES. It requests the source profile, then the destination profile, then the image. The two profile responses must be valid profiles or the chain stops early; the image response goes to the WIC decoder. The bytes are never sent anywhere and you never see them. -t IS ACCEPTED and it parses the payload HERE, so THIS machine makes the three requests. Only point them at endpoints you own. WHAT A CALLBACK PROVES. That the target resolved your hosts and issued the requests. It is not proof of a native vulnerability, of code execution, or of any data returning to you. Default value: "false".	false	false

rawinput

Put the three URIs into the payload template exactly as typed, instead of escaping them for XML element text. Use this only when you have already escaped the values yourself. It also turns off the check that the finished payload still carries each URI as its own token, because there is then no text of yours left to compare against.

WHAT TO PUT IN. Three absolute URIs the target's WebRequest stack accepts, one per input: -c the image, e.g. http://h/i?a=b&c=d --source-profile the source ICC profile --destination-profile the destination ICC profile None of the three may contain a SPACE: the target's constructor splits the one argument on the space character, so a space would break the triple. A query string is fine.

WHAT THE TARGET DOES. It requests the source profile, then the destination profile, then the image. The two profile responses must be valid profiles or the chain stops early; the image response goes to the WIC decoder. The bytes are never sent anywhere and you never see them.

-t IS ACCEPTED and it parses the payload HERE, so THIS machine makes the three requests. Only point them at endpoints you own.

WHAT A CALLBACK PROVES. That the target resolved your hosts and issued the requests. It is not proof of a native vulnerability, of code execution, or of any data returning to you. Default value: "false".

false

Credit: [Finders: Soroush Dalili]

All modules · Full catalog JSON