XamlAssemblyLoadFromFile
gadget
Loads assembly using XAML. This gadget interprets the command parameter as the path to the .cs file that should be compiled as an exploit class. Use a semicolon to separate the file from any additional required assemblies, e.g., '-c ExploitClass.cs;System.dll'. Variant 1 also takes rootcontainer (1 SortedSet, 2 SortedDictionary, 3 TreeSet) to dodge a SortedSet wire-name blocklist; SoapFormatter supports roots 1 and 3. It self-tests in a child process.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g XamlAssemblyLoadFromFile -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| 1 | BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter | source-code-file | built-in, wpf, net-framework | net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
| 2 | BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter | source-code-file | extra-assembly, wpf, net-framework | net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1 |
Variants
- 1: TypeConfuseDelegate wrapper (default) (default)
- 2: TextFormattingRunProperties wrapper
Options (2)
| Option | Help | Default | Required |
|---|---|---|---|
var|variant= | Choices: 1 -> use TypeConfuseDelegateGenerator [default], 2 -> use TextFormattingRunPropertiesMarshal Default value: "1". Suggested values: 1, 2. | 1 | false |
rootcontainer= | Serialized root container of the TypeConfuseDelegate wrapper: 1 -> SortedSet [default], 2 -> SortedDictionary, 3 -> TreeSet. 2 and 3 evade a binder or blocklist that rejects the exact SortedSet wire type name. SoapFormatter supports 1 and 3, not 2. Not used by the TextFormattingRunProperties wrapper (variant 2), which has no container. The (2) formatter annotation counts wrapper variants, not root-container choices. Default value: "1". Suggested values: 1, 2, 3. | 1 | false |
Credit: [Finders: Soroush Dalili] [Contributors: russtone]