WbemClassObjectUnmarshal
gadget
Feeds a serialized byte[] to native CoUnmarshalInterface. Variant 1 calls out to your host on RPC 135; variant 2 ships a blob you built.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g WbemClassObjectUnmarshal -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializer, Json.NET, FsPickler | host | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, SoapFormatter, LosFormatter, NetDataContractSerializer, DataContractSerializer, Json.NET, FsPickler | local-file | built-in, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: Call out to a host: ysonet builds the OBJREF for you from -c <host> (default) (default)
- 2: Bring your own blob: ship the file in -c byte for byte - NOT a code-execution variant
Options (2)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Which blob to put in the payload. BOTH variants do the same thing to the target - hand a byte[] to native CoUnmarshalInterface - and differ only in WHO writes those bytes: variant 1 writes them for you from a host name, variant 2 ships a file you wrote yourself. Neither one is a code-execution variant. Choices: 1 (default) - build an OBJREF_STANDARD here from -c "<host>". The target resolves that host and connects to it to resolve the OXID, which is the callback. Give a BARE host name or IP: the RPC endpoint inside a string binding is ignored and resolution always goes to port 135, so "host[1234]" or "host:1234" is refused rather than shipped as a payload that cannot fire. The call is not authenticated, so this proves a connection, not NTLM coercion. It always ends in a COM error on the target (OR_INVALID_OXID when the host answers, RPC_S_SERVER_UNAVAILABLE when it does not) - the callback has already happened by then. -t is accepted here and behaves as it does on the other network gadgets: it deserializes the payload on THIS machine, so YOUR machine makes the callback. Use it to check the payload and your listener, and add --debugmode to see the COM error it ends with. 2 (research) - read a prepared OBJREF from the local file named by -c and ship it as is. The file must be readable, non-empty and at most 1048576 bytes. This is an escape hatch, not a stronger version of variant 1: ysonet does not parse, validate or understand your bytes, so the effect is entirely whatever they mean to CoUnmarshalInterface on the target - which may be nothing, a callout of your own design, or a crash. It does NOT by itself give code execution; it only gives you the delivery channel. Use it when you have built a blob variant 1 cannot express, such as an OBJREF_CUSTOM. -t is REFUSED for this variant, because self-testing would feed your unparsed bytes to native COM on this machine. Default value: "1". Suggested values: 1, 2. | 1 | false |
rootcarrier= | Which type sits at the SERIALIZED ROOT. Orthogonal to variant: it changes the type name on the wire and nothing else. Both carriers hand the same byte[] to the same native CoUnmarshalInterface call, so the effect, the input and the blob are identical. This is NOT a SerializationBinder bypass - a binder is consulted for every type in the stream, nested ones included, so a binder that blocks the inner type still blocks carrier 2. Choices: 1 (default) - the bare System.Management.IWbemClassObjectFreeThreaded, which is internal to System.Management. 2 - wrap it in the PUBLIC System.Management.ManagementBaseObject, which holds it in its "wbemObject" member and passes it to the same constructor. Use it when the target names its own root type (a plain DataContractSerializer consumer can only ever name a public one), or when a rule keys on the internal name. Not available with DataContractSerializer or FsPickler; those two keep working on carrier 1. The (2) formatter annotation counts blob variants, not root-carrier choices. Default value: "1". Suggested values: 1, 2. | 1 | false |
Credit: [Finders: James Forshaw, SCRT] [Contributors: Soroush Dalili]