Clipboard

plugin

Generates payload for DataObject and copies it into the clipboard - ready to be pasted in affected apps

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -p Clipboard -h

Target declarations

Runtime tokens: unspecified.

Structured formatter and requirement metadata is not declared. Read the description and option help for conditions.

Options (8)

Option	Help	Default	Required
m|mode=	delivery mode (default: winforms). 'winforms': a BinaryFormatter gadget under a WinForms format (see --format). 'wpfxaml': an ObjectDataProvider XAML string under the WPF 'Xaml' format, for InkCanvas/RichTextBox paste; fires only if the target enabled the legacy clipboard switch or predates the CVE-2020-0605/0606 mitigation (see the header comment for details). Suggested values: winforms, wpfxaml.	winforms	false
F|format=	winforms mode only. The object format: Csv, DeviceIndependentBitmap, DataInterchangeFormat, PenData, RiffAudio, WindowsForms10PersistentObject, System.String, SymbolicLink, TaggedImageFileFormat, WaveAudio. Default: WindowsForms10PersistentObject (the only one that works in Feb 2020 as a result of an incomplete silent patch - will not be useful to target text-based fields anymore) Suggested values: Csv, DeviceIndependentBitmap, DataInterchangeFormat, PenData, RiffAudio, WindowsForms10PersistentObject, System.String, SymbolicLink, TaggedImageFileFormat, WaveAudio.	WindowsForms10PersistentObject	false
xamlvariant=	wpfxaml mode only. ObjectDataProvider XAML variant: 1 = bare ObjectDataProvider, 2 = ResourceDictionary wrapper (looks like real clipboard XAML). Default: 2 Default value: "2". Suggested values: 1, 2.	2	false
c|command=	the command to be executed Required.	Not declared	true
t|test	whether to run payload locally. In wpfxaml mode this simulates the WPF paste path (restrictive vs legacy) and runs the command if it fires. Default: false	false	false
minify	Whether to minify the payloads where applicable (experimental). Default: false	false	false
ust|usesimpletype	This is to remove additional info only when minifying and FormatterAssemblyStyle=Simple. Default: true	true	false
rawcmd	Command will be executed as is without `cmd /c ` being appended (anything after the first space is an argument). Default value: "false".	false	false

Mode declarations

[
  {
    "name": "WinForms (BinaryFormatter under a WinForms format)",
    "description": "TextFormattingRunProperties under a WinForms clipboard format.",
    "options": [
      "command",
      "rawcmd",
      "format",
      "test",
      "minify",
      "usesimpletype"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "winforms"
    }
  },
  {
    "name": "WPF XAML (ObjectDataProvider under the Xaml format)",
    "description": "ObjectDataProvider XAML under the WPF 'Xaml' clipboard format.",
    "options": [
      "command",
      "rawcmd",
      "xamlvariant",
      "test",
      "minify",
      "usesimpletype"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "wpfxaml"
    }
  }
]

Credit: Soroush Dalili

All modules · Full catalog JSON