FileLogTraceListener
gadget
Microsoft.VisualBasic.Logging.FileLogTraceListener creates the supplied directory through CustomLocation. With elevated privileges, directory creation in sensitive locations may cause denial of service. On .NET Framework 3.5 both JavaScriptSerializer and DataContractJsonSerializer reach it with --legacyfx (Microsoft.VisualBasic is 8.0.0.0 there, not 10.0.0.0); DataContractJsonSerializer additionally needs a consumer whose root type is that same identity.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g FileLogTraceListener -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| Default | Json.NET, FastJson, JavaScriptSerializer, YamlDotNet, MessagePackTypeless, MessagePackTypelessLz4, SharpSerializerXml, DataContractJsonSerializer, Xaml | target-path | built-in, net-framework | net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
rawinput | Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input. Default value: "false". | false | false |
Credit: [Finders: Piotr Bazydlo]