Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handling gadgets that don't result in command execution #148

Open
NinesPsygnosis opened this issue Mar 18, 2023 · 0 comments
Open

Handling gadgets that don't result in command execution #148

NinesPsygnosis opened this issue Mar 18, 2023 · 0 comments

Comments

@NinesPsygnosis
Copy link
Contributor

NinesPsygnosis commented Mar 18, 2023

(Ideally I'd start a discussion for this, but I don't believe that's enabled for this repository.)

Currently Ysoserial.NET primarily works to support generation of gadget payloads that execute a command on deserialization. There are some exceptions to this rule as some gadgets allow you to specify files and there is a plugin option to handle special cases for specific technologies.

I've been doing quite a lot of research recently into different types of gadgets that would allow a researcher to generate payloads that can perform other useful actions, such as exfiltrating files via XXE gadget chains during deserialization. I've even got a PoC that works on .NET Core and .NET 7, utilizing the serializer to bypass the default XML parsing security configurations introduced in .NET 4.5.2.

I believe there is probably some interest in being able to generate these, but I'm not sure what the consensus would be on how to approach it with respect to listing the gadgets and avoiding cluttering the command line options.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant