Xps

plugin

Generates a malicious XPS document (CVE-2020-0605) for XpsDocument or PrintQueue.AddJob(path) - binary output, use --outputpath to save it as an .xps file

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -p Xps -h

Target declarations

Runtime tokens: unspecified.

Structured formatter and requirement metadata is not declared. Read the description and option help for conditions.

Options (6)

Option	Help	Default	Required
m|mode=	which markup part carries the payload: 'fdseq' (default, the FixedDocumentSequence start part), 'fdoc' (the FixedDocument part), 'fpage' (the FixedPage part), or 'all'. The parts were patched at different times, so this chooses what a given target build still parses unrestricted. Default value: "fdseq". Suggested values: fdseq, fdoc, fpage, all.	fdseq	false
c|command=	the command to be executed Required.	Not declared	true
t|test	whether to run the payload locally. This opens the generated document twice: once with the patched default (must be blocked) and once with the legacy switches flipped FOR THIS PROCESS ONLY, which runs your command. Default: false	false	false
minify	Whether to minify the payloads where applicable (experimental). Default: false	false	false
ust|usesimpletype	This is to remove additional info only when minifying and FormatterAssemblyStyle=Simple. Default: true	true	false
rawcmd	Command will be executed as is without `cmd /c ` being appended (anything after the first space is an argument). Default value: "false".	false	false

Mode declarations

[
  {
    "name": "FixedDocumentSequence part (.fdseq)",
    "description": "Payload in the start part, parsed by XpsDocument.GetFixedDocumentSequence.",
    "options": [
      "command",
      "test",
      "minify",
      "usesimpletype",
      "rawcmd"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "fdseq"
    }
  },
  {
    "name": "FixedDocument part (.fdoc)",
    "description": "Payload in the document part, parsed by XpsValidatingLoader via DocumentReference.",
    "options": [
      "command",
      "test",
      "minify",
      "usesimpletype",
      "rawcmd"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "fdoc"
    }
  },
  {
    "name": "FixedPage part (.fpage)",
    "description": "Payload in the page part, parsed by XpsValidatingLoader via PageContent.",
    "options": [
      "command",
      "test",
      "minify",
      "usesimpletype",
      "rawcmd"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "fpage"
    }
  },
  {
    "name": "Every part (unknown patch level)",
    "description": "Payload in all three markup parts at once.",
    "options": [
      "command",
      "test",
      "minify",
      "usesimpletype",
      "rawcmd"
    ],
    "requiredOptions": [
      "command"
    ],
    "preset": {
      "mode": "all"
    }
  }
]

Credit: Soroush Dalili

All modules · Full catalog JSON