ResourceDictionary
gadget
ResourceDictionary.Source makes the target fetch -c and load it as WPF markup. A UNC path instead coerces an SMB session, which sends authentication material.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g ResourceDictionary -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| Default | Xaml | remote-url, unc-path, target-path | built-in, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
rawinput | Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input. Default value: "false". | false | false |
Credit: [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]