Resx
plugin
Generates RESX and .RESOURCES files
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -p Resx -hTarget declarations
Runtime tokens: net-fx-2.0, net-fx-3.0, net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1.
Structured formatter and requirement metadata is not declared. Read the description and option help for conditions.
Options (13)
| Option | Help | Default | Required |
|---|---|---|---|
M|mode= | the payload mode: indirect_resx_file, CompiledDotResources (useful for CVE-2020-0932 for example), BinaryFormatter, SoapFormatter. Suggested values: indirect_resx_file, CompiledDotResources, BinaryFormatter, SoapFormatter. Required. | Not declared | true |
c|command= | the command to be executed in BinaryFormatter and CompiledDotResources. If this is provided for SoapFormatter, it will be used as a file for ActivitySurrogateSelectorFromFile | Not declared | false |
g|gadget= | The gadget chain used for BinaryFormatter and CompiledDotResources (default: TextFormattingRunProperties). Values: see --list gadgets. | TextFormattingRunProperties | false |
F|file= | UNC file path location: this is used in indirect_resx_file mode. | Not declared | false |
type= | indirect_resx_file mode only: the type name the TARGET resolves with Type.GetType when it converts the file reference, which is what decides the effect. Default: System.Resources.ResXResourceSet, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, whose Stream constructor reads the file as a .resources document. System.String makes the target read the file back as text instead, and any other type with a public constructor taking one Stream is activated with the file's bytes. Default value: "System.Resources.ResXResourceSet, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089". | System.Resources.ResXResourceSet, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 | false |
enc= | indirect_resx_file mode only: the encoding name the target passes to Encoding.GetEncoding, used only when --type is System.String. Omitted by default, which makes the target use Encoding.Default. | Not declared | false |
of|outputfile= | a file path location for CompiledDotResources to store the .resources file (default: payload.resources) | payload.resources | false |
t|test | Whether to run payload locally. Default: false | false | false |
minify | Whether to minify the payloads where applicable (experimental). Default: false | false | false |
ust|usesimpletype | This is to remove additional info only when minifying and FormatterAssemblyStyle=Simple. Default: true | true | false |
rawcmd | Command will be executed as is without `cmd /c ` being appended (anything after the first space is an argument). Default value: "false". | false | false |
legacyfx | Target the .NET Framework 2.0/3.0/3.5 (CLR v2) generation. This reaches the GADGET only. The .resx reader/writer headers remain at 4.0.0.0 because ResXResourceReader treats them as descriptive metadata; the complete document is tested on CLR v2. Default: false | false | false |
i-understand-dos | Acknowledge that a denial-of-service gadget can disrupt or terminate the target process. It is required to generate one and is not needed by any other gadget. Default value: "false". | false | false |
Credit: Soroush Dalili