So
@irsdl@infosec.exchange released a new version of YSoNet (a forge of ysoserial.net), with some cool new features / gadgets:
▸ DataTable + DataTableTypeSpoof
Same-graph DataTable root carrier for RCE. No nested BinaryFormatter or extra binder boundary. TypeSpoof emits a real DataTable subclass, so blocking only the exact DataTable wire name may not prevent reconstruction.
▸ TypeConfuseDelegateFileOperations
Five delegate-confusion variants for writing, copying, moving and truncating files. No child process, compiler or WPF required.
▸ AssemblyInstallerLoad
Loads a specified DLL from a local or UNC path and instantiates [RunInstaller(true)] installer types. Supported by nine serializers.
▸ DynamicUpdateMapExtension
Passes x:XData to NetDataContractSerializer without a binder, allowing a XAML-only sink to carry an NDCS gadget.
🔧 NOTABLE UPDATES
▸ TypeConfuseDelegate now supports SortedDictionary and TreeSet roots, useful for testing blocklists that match only the exact SortedSet wire name.
▸ WindowsIdentity and WindowsClaimsIdentity can carry the inner BinaryFormatter graph through actor, bootstrapContext, claims or WIF’s _actor sink. Variant numbering is now aligned across both gadgets and all serializers.
🔗
https://github.com/irsdl/ysonet
http://ysonet.com |
http://ysonet.net
#AppSec #YSoNet
