WindowsIdentity
gadget
The variant picks which ClaimsIdentity key carries the inner BinaryFormatter payload.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g WindowsIdentity -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 3 | BinaryFormatter, Json.NET, DataContractSerializer, NetDataContractSerializer, SoapFormatter, LosFormatter | command | built-in, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: actor member (default) (default)
- 2: bootstrapContext member
- 3: claims member
Options (1)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Which SerializationInfo key carries the inner BinaryFormatter payload. All three names start with 'System.Security.ClaimsIdentity.' and end with: 1 = actor (default, the shortest), 2 = bootstrapContext, 3 = claims. All three reach the same unbindered BinaryFormatter in ClaimsIdentity.Deserialize and have the same effect; they differ only in the member NAME on the wire. An unknown number falls back to 1. Default value: "1". Suggested values: 1, 2, 3. | 1 | false |
Credit: [Finders: Levi Broderick] [Contributors: Alvaro Munoz, Soroush Dalili]