DataSetOldBehaviourFromFile
gadget
Another variant of the DataSetOldBehaviour gadget. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g DataSetOldBehaviourFromFile -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, LosFormatter | source-code-file | built-in, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, LosFormatter | source-code-file | built-in, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: default DataSet schema (default) (default)
- 2: List<ExpandedWrapper> array schema
Options (3)
| Option | Help | Default | Required |
|---|---|---|---|
spoofedAssembly= | The assembly name you want to use in the generated serialized object (example: 'mscorlib' or use 'default' for System.Data) Suggested values: mscorlib, default. | Not declared | false |
var|variant= | Payload variant number where applicable. Choices: 1 (default), 2 Default value: "1". Suggested values: 1, 2. | 1 | false |
compressed | GZip-compress the embedded assembly bytes so the payload is much smaller for a large assembly. The payload decompresses them at deserialization time via a GZipStream in the XAML chain (works with both variants). Default value: "false". | false | false |
Credit: [Finders: Steven Seeley, Markus Wulftange, Khoa Dinh] [Contributors: Soroush Dalili]