TypeConfuseDelegateNetFx40
gadget
.NET Framework 4.0-only: reconstructs that runtime's non-serializable Array.FunctorComparer<string> through Workflow ObjectSerializedRef, preloads it before a SortedSet<string> in List<object>, and lets the set call the confused String.Compare/Process.Start delegate while rebuilding. The target needs System.Workflow.ComponentModel. BinaryFormatter, SoapFormatter and LosFormatter are supported; the SOAP form is a direct List<object>/SortedSet<string> document with no outer carrier or nested BinaryFormatter stream. NetDataContractSerializer cannot reproduce the required memberDatas contract. Later CLR 4 builds use an incompatible private comparer shape, so local -t is refused; --legacyfx is also invalid because this graph requires CLR4 identities. When to use it: only when the target's INSTALLED framework is genuinely 4.0 (4.5+ never installed). .NET 4.5+ replaces 4.0 in place, so on any 4.5 to 4.8 target use TypeConfuseDelegate instead. That includes a 'v4.0' IIS app pool, which selects CLR 4, not .NET 4.0, and a web.config targetFramework of 4.0, which only sets compatibility quirks. Decide by the installed framework, not the app pool label: if HKLM ...NDP\v4\Full has a 'Release' value it is 4.5+, and absent means genuine 4.0. How to test it: run ysonet.Net40TestHost.exe --probe on the target (shape=netfx40 confirms genuine 4.0), then its --deserialize fires the payload; a Windows image with 4.0 and no 4.5+ update, or an isolated 4.0 VM, is a suitable victim.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g TypeConfuseDelegateNetFx40 -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| Default | BinaryFormatter, SoapFormatter, LosFormatter | command | built-in, net-framework | net-fx-4.0 |
No module-specific options declared.
Credit: [Finders: James Forshaw] [Contributors: Soroush Dalili]