TextFormattingRunProperties
gadget
This normally generates the shortest payload
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g TextFormattingRunProperties -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| Default | BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter, DataContractSerializer, Json.NET | command | extra-assembly, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Options (2)
| Option | Help | Default | Required |
|---|---|---|---|
xamlurl= | This is to create a very short payload when the affected box can read the target XAML URL e.g. "http://example.local/x" (can be a UNC path on a shared drive or a path on the local system). It carries the ResourceDictionary gadget instead of ObjectDataProvider, so the target FETCHES and loads that URL rather than running a command, and the command parameter is ignored. The shorter the better! | Not declared | false |
hasRootDCS | Include a root element with the DataContractSerializer payload. This option applies only to DataContractSerializer; other formatters are refused. Default value: "false". | false | false |
Credit: [Finders: Oleksandr Mirosh and Alvaro Munoz] [Contributors: Oleksandr Mirosh, Soroush Dalili, Piotr Bazydlo]