WSManPluginInstance

gadget

Builds a Windows PowerShell type whose finalizer terminates the target process. The effect is asynchronous and needs System.Management.Automation.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g WSManPluginInstance -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
Default	BinaryFormatter, SoapFormatter, LosFormatter, Json.NET, Xaml, FastJson, JavaScriptSerializer, YamlDotNet, SharpSerializerXml, SharpSerializerBinary, MessagePackTypeless, MessagePackTypelessLz4, DataContractSerializer, DataContractJsonSerializer, NetDataContractSerializer, XmlSerializer	none	extra-assembly, net-framework	unspecified

Options (1)

Option Help Default Required

Option	Help	Default	Required
`assembly=`	The assembly display name written into the payload. Default: "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" which is Windows PowerShell's GAC identity. The 3.0.0.0 assembly version has been Windows PowerShell's since PowerShell 3.0 and is still what Windows PowerShell 5.1 ships (verified there), so the default is what you want against a normal Windows target. The value is written EXACTLY as typed and only an empty one is refused. Whether a name binds is the target's decision, not this tool's, so a repackaged, renamed, side-by-side or differently versioned copy is yours to point at. The TYPE name never changes: System.Management.Automation.Remoting.WSManPluginManagedEntryInstanceWrapper. PowerShell 7 ships System.Management.Automation under a different identity on a different runtime. Nothing here has been reproduced against it, so there is no preset for it and no claim about it. WHAT THE PAYLOAD DOES. The target builds the type; its finalizer frees a GCHandle that was never allocated, which throws on the finalizer thread, and an exception there terminates the process. The effect is ASYNCHRONOUS - it waits for a collection - so do not expect it at the moment of deserialization. Default value: "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35".	System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35	false

assembly=

The assembly display name written into the payload. Default: "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" which is Windows PowerShell's GAC identity. The 3.0.0.0 assembly version has been Windows PowerShell's since PowerShell 3.0 and is still what Windows PowerShell 5.1 ships (verified there), so the default is what you want against a normal Windows target.

The value is written EXACTLY as typed and only an empty one is refused. Whether a name binds is the target's decision, not this tool's, so a repackaged, renamed, side-by-side or differently versioned copy is yours to point at. The TYPE name never changes: System.Management.Automation.Remoting.WSManPluginManagedEntryInstanceWrapper.

PowerShell 7 ships System.Management.Automation under a different identity on a different runtime. Nothing here has been reproduced against it, so there is no preset for it and no claim about it.

WHAT THE PAYLOAD DOES. The target builds the type; its finalizer frees a GCHandle that was never allocated, which throws on the finalizer thread, and an exception there terminates the process. The effect is ASYNCHRONOUS - it waits for a collection - so do not expect it at the moment of deserialization. Default value: "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35".

System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35

false

Credit: [Finders: Oleksandr Mirosh, Alvaro Munoz] [Contributors: Soroush Dalili]

All modules · Full catalog JSON