ViewState
plugin
Generates a ViewState using known MachineKey parameters
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -p ViewState -hTarget declarations
Runtime tokens: net-fx-2.0, net-fx-3.0, net-fx-3.5, net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1.
Structured formatter and requirement metadata is not declared. Read the description and option help for conditions.
Options (28)
| Option | Help | Default | Required |
|---|---|---|---|
examples | Show a few examples. Other parameters will be ignored. Default value: "false". | false | false |
dryrun | Create a valid ViewState without using an exploit payload. The gadget and command parameters will be ignored. Default value: "false". | false | false |
g|gadget= | A gadget chain that supports LosFormatter. Default: TextFormattingRunProperties. Default value: "TextFormattingRunProperties". Values: see --list gadgets. | TextFormattingRunProperties | false |
c|command= | The command suitable for the used gadget. A few gadgets ignore it and run a fixed payload instead - ActivitySurrogateSelector is the one you are most likely to pick - and for those any placeholder works. | Not declared | false |
rawcmd | Command will be executed as is without `cmd /c ` being appended (anything after the first space is an argument). Default value: "false". | false | false |
s|stdin | The command to be executed will be read from standard input (the first line, up to 2,050 bytes). A non-empty command wins. Default value: "false". | false | false |
usp|unsignedpayload= | The unsigned LosFormatter payload (base64 encoded). The gadget and command parameters will be ignored. | Not declared | false |
isfileusp | Indicates that the unsigned payload contains a file name (e.g., payload.txt). Default value: "false". | false | false |
vsg|generator= | The __VIEWSTATEGENERATOR value in HEX, useful for .NET <= 4.0. When not empty, 'legacy' will be used and 'path' and 'apppath' will be ignored. | Not declared | false |
path= | The target web page (optional; only used to compute the __VIEWSTATEGENERATOR when 'generator' is not given). Example: /app/folder1/page.aspx. | Not declared | false |
pathisclass | Indicates that the path is a class name and should not be modified. Default value: "false". | false | false |
apppath= | The IIS application path (optional; used to simulate TemplateSourceDirectory). Example: /myapp/. Leave empty for the site root. | Not declared | false |
islegacy | Use the legacy algorithm suitable for .NET 4.0 and below. Default value: "false". | false | false |
isencrypted | Use when the legacy algorithm is used to bypass WAFs. Default value: "false". | false | false |
vsuk|VSUK|viewstateuserkey=|ViewStateUserKey= | Sets the ViewStateUserKey parameter, sometimes used as the anti-CSRF token. | Not declared | false |
da|DA|decryptionalg=|DecryptionAlg= | The encryption algorithm can be set to DES, 3DES, or AES. Default: AES. Suggested values: DES, 3DES, AES. | AES | false |
dk|DK|decryptionkey=|DecryptionKey= | The decryptionKey attribute from machineKey. Only needed when encryption is used (for example with 'isencrypted'). | Not declared | false |
va|VA|validationalg=|ValidationAlg= | The validation algorithm can be set to SHA1, HMACSHA256, HMACSHA384, HMACSHA512, MD5, 3DES, or AES. Default: HMACSHA256. Suggested values: SHA1, HMACSHA256, HMACSHA384, HMACSHA512, MD5, 3DES, AES. | HMACSHA256 | false |
vk|VK|validationkey=|ValidationKey= | The validationKey attribute from machineKey in the web.config file. Required. | Not declared | true |
cv|currentviewstate= | To validate and decrypt the provided viewstate value if it has been encrypted. | Not declared | false |
showraw | Stop URL-encoding the result. Default: false. | false | false |
minify | Minify the payloads where applicable (experimental). Default: false. | false | false |
ust|usesimpletype | Remove additional info only when minifying and FormatterAssemblyStyle=Simple. Default: true. | true | false |
osf|objectstateformatter | This is to simulate ObjectStateFormatter with a MAC encoding key on its own. Default value: "false". | false | false |
mk|mackey= | The ObjectStateFormatter MAC encoding key in base64. Only used with the 'osf' option. | Not declared | false |
isdebug | Show useful debugging messages. Default value: "false". | false | false |
legacyfx | Target the .NET Framework 2.0/3.0/3.5 (CLR v2) generation. This reaches the GADGET only; the ViewState envelope and its signature name no framework assembly. Pair it with 'islegacy', which selects the matching pre-4.5 signing algorithm. Default: false | false | false |
i-understand-dos | Acknowledge that a denial-of-service gadget can disrupt or terminate the target process. It is required to generate one and is not needed by any other gadget. Default value: "false". | false | false |
Mode declarations
[
{
"name": "Exploit (gadget runs a command)",
"description": "Build and sign a gadget payload. Needs a command and a validationkey.",
"options": [
"gadget",
"command",
"rawcmd",
"validationkey",
"validationalg",
"path",
"apppath",
"pathisclass",
"generator",
"islegacy",
"isencrypted",
"decryptionkey",
"decryptionalg",
"viewstateuserkey",
"objectstateformatter",
"mackey",
"currentviewstate",
"showraw",
"minify",
"usesimpletype",
"legacyfx"
],
"requiredOptions": [
"command",
"validationkey"
],
"preset": {
"dryrun": ""
}
},
{
"name": "Dry run (valid ViewState, no exploit)",
"description": "A signed but harmless ViewState. Needs only a validationkey.",
"options": [
"validationkey",
"validationalg",
"path",
"apppath",
"pathisclass",
"generator",
"islegacy",
"isencrypted",
"decryptionkey",
"decryptionalg",
"viewstateuserkey",
"objectstateformatter",
"mackey",
"currentviewstate",
"showraw",
"minify",
"usesimpletype",
"legacyfx"
],
"requiredOptions": [
"validationkey"
],
"preset": {
"dryrun": "true"
}
},
{
"name": "Unsigned payload (sign an existing one)",
"description": "Sign a base64 LosFormatter payload you already have.",
"options": [
"unsignedpayload",
"isfileusp",
"validationkey",
"validationalg",
"path",
"apppath",
"pathisclass",
"generator",
"islegacy",
"isencrypted",
"decryptionkey",
"decryptionalg",
"viewstateuserkey",
"objectstateformatter",
"mackey",
"currentviewstate",
"showraw",
"minify",
"usesimpletype",
"legacyfx"
],
"requiredOptions": [
"unsignedpayload",
"validationkey"
],
"preset": {
"dryrun": ""
}
}
]Credit: Soroush Dalili