ResXFileRef
gadget
Runs the ResXFileRef type converter on the target, which opens the -c path (a UNC path works) and builds the type named in the payload. The type name decides the effect, so pick the variant that matches what you want.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g ResXFileRef -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | Xaml, YamlDotNet | target-path, unc-path | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | Xaml, YamlDotNet | target-path, unc-path | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 3 | Xaml, YamlDotNet | target-path, unc-path | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: Read the file back: the target returns the file's text as the value
- 2: Load a .resources file: the target's ResourceSet reads it with BinaryFormatter (default) (default)
- 3: Activate a type you name, with the file's bytes as its Stream argument - NOT necessarily code execution
Options (4)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Which of the converter's branches the payload asks for. All three open -c on the target and differ only in the TYPE NAME the payload carries, which is what the converter does with the bytes. Choices: 1 - read the file back. The type name is System.String, so the target runs StreamReader(path, encoding).ReadToEnd() and the file's TEXT becomes the deserialized value. Use --enc to pick the encoding. -t reads the file on THIS machine. 2 (default) - load a .resources file. The type name is System.Resources.ResourceSet, whose Stream constructor runs a plain BinaryFormatter over the file, so -c should point at a .resources document you host (build one with -p Resx -m CompiledDotResources). -t deserializes the payload HERE, which runs that BinaryFormatter over -c on THIS machine (a self-exploit) - only -t a .resources file you trust. 3 (research) - activate a type you name with --type. The target reads the whole file into a MemoryStream and calls Activator.CreateInstance(yourType, ..., new object[]{ stream }), so the type needs one public instance constructor taking a Stream. This is an escape hatch, NOT a stronger version of variant 2: what happens is decided by the type you chose and ysonet cannot know it. -t activates that type on THIS machine, so only -t a type and file you trust. Default value: "2". Suggested values: 1, 2, 3. | 2 | false |
type= | Variant 3 only: the type the TARGET resolves with Type.GetType and then activates with the file's bytes. Give an assembly qualified name ("Some.Namespace.SomeType, SomeAssembly") unless it is an mscorlib type, which resolves from its bare name. It must have a public instance constructor taking one System.IO.Stream; a name that does not resolve makes the target throw, loudly, before anything is read. | Not declared | false |
enc= | Variant 1 only: the encoding name the target passes to Encoding.GetEncoding for the text read, for example utf-8 or windows-1252. Leave it out and the target uses Encoding.Default. | Not declared | false |
rawinput | Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input. Default value: "false". | false | false |
Credit: [Finders: Soroush Dalili]