TypeConfuseDelegateFileOperations
gadget
Performs a file operation on the target through the TypeConfuseDelegate delegate confusion, without starting a process: write text from a local file, copy, move, move a directory, or create/truncate an empty file. The var/variant option picks the operation and decides what -c means; the two strings only have to DIFFER, in either order. This CLR4.5+ graph does not support --legacyfx.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g TypeConfuseDelegateFileOperations -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter | target-path, local-file | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter | target-path | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 3 | BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter | target-path | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 4 | BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter | target-path | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 5 | BinaryFormatter, NetDataContractSerializer, SoapFormatter, LosFormatter | target-path | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: write text from a local file (default) (default)
- 2: copy a file on the target
- 3: move a file on the target
- 4: move a directory on the target
- 5: create or truncate an empty file
Options (2)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | File operation: 1 -> write text from a local file [default] (-c "targetPath;localContentFile"), 2 -> copy a file, 3 -> move a file, 4 -> move a directory (2-4 take -c "sourcePath;destinationPath"), 5 -> create or truncate an empty file (-c "targetPath"). Every path except the local content file is a path on the TARGET and is never touched here. Only the first ';' splits the value, so the second field may contain more of them. The two strings only have to DIFFER, in either order; an equal pair is refused because the sorted container would collapse it to one element and the payload would do nothing. Preconditions on the target: write and empty create or overwrite the file but do not create its parent directory; copy and both moves do not overwrite an existing destination; dirmove needs an existing source, a free destination and the same volume; all of them need the target process to have the file-system rights. --minify with NetDataContractSerializer or SoapFormatter is refused when it would rewrite either string (the XML minifier trims trailing whitespace, drops a carriage return, and collapses "; "); SOAP is also refused without --minify if its XML writer loses a value. BinaryFormatter and LosFormatter minify the same input safely. Minification may therefore be refused when content has characters that must survive exactly. Default value: "1". Suggested values: 1, 2, 3, 4, 5. | 1 | false |
rootcontainer= | Serialized root container, independent of the five file-operation variants: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet. BinaryFormatter, NetDataContractSerializer and LosFormatter support all three roots. SoapFormatter supports all five file operations with roots 1 and 3, but not root 2. The (5) formatter annotation counts file-operation variants, not root choices. Roots 2 and 3 evade a binder or blocklist that rejects the exact SortedSet wire type name. Changing this option does not change the selected file operation. Default value: "1". Suggested values: 1, 2, 3. | 1 | false |
Credit: [Finders: James Forshaw] [Contributors: Soroush Dalili]