WindowsClaimsIdentity
gadget
Requires Microsoft.IdentityModel.Claims namespace (not default GAC)
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g WindowsClaimsIdentity -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | extra-assembly, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | extra-assembly, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 3 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | extra-assembly, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 4 | BinaryFormatter, NetDataContractSerializer, LosFormatter | command | extra-assembly, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: actor member (default) (default)
- 2: bootstrapContext member
- 3: claims member
- 4: WIF _actor member (its own sink; BF/Los/NDCS only)
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Which member carries the inner BinaryFormatter payload. 1, 2 and 3 are the ClaimsIdentity keys, named the same way and numbered the same way as on the WindowsIdentity gadget: they all start with 'System.Security.ClaimsIdentity.' and end with 1 = actor (default), 2 = bootstrapContext, 3 = claims. 4 is different: it is the WIF type's OWN _actor member, a separate sink inside the WIF assembly rather than in mscorlib, and it exists only on BinaryFormatter, LosFormatter and NDCS. NOTE: what 1-3 build CHANGED when the numbering was unified - it used to depend on the formatter. An unknown number falls back to 1. Default value: "1". Suggested values: 1, 2, 3, 4. | 1 | false |
Credit: [Finders: Soroush Dalili]