dotnet

package
v1.48.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 15, 2025 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Overview

This file contains all of the gadget creation functions for use in exploits. Calling one should be as simple as: payload, ok := CreateWindowsIdentity("cmd", "/c calc", dotnet.BinaryFormatter) if !ok{ return "", false }

The exceptions are the CreateObjectRef and CreateVeeamCryptoKeyInfo as those take (url string, formatter string) instead.

Any of the Create gadget funcs can be called with "" as their formatter which will return just the binary stream of the object, which is the same as binaryformatter.

Information for new gadget development:

These objects are basically just a series of 'records' that ultimately define a class and it's members.

The general format is something like

serializationHeaderRecord
+ binLibString
CLASSWITHMEMBERSANDTYPES(ClassObjectID INT32 (usually incremented from 1) + ClassName + MemberCount, MemberNames + AdditionalInfo + []byte{member0Type, member1Type, memberNType, ...} + Library ID INT32 + Array of Membervalues) +
string(byte(RecordTypeEnumMap["MessageEnd"])) (just a 0xb)

Sometimes this format gets a bit more complicated because the member values array will contain CLASSWITHMEMBERSANDTYPES records as array items so it's a nested class. Also where ArraySingleStringRecord and ArraySinglePrimitiveRecord are concerned, these get referenced in member values and then are appended after the class record like so:

payload := serializationHeaderRecordString +
	binaryLibraryRecordString +
	classWithMembersAndTypesString +
	arraySingleStringRecordString +
	string(byte(RecordTypeEnumMap["MessageEnd"]))

There should be enough information in the existing gadgets to infer from in order to make new gadgets.

Index

Constants

View Source
const (
	LOSFormatter                = "LOSFormatter"
	BinaryFormatter             = "BinaryFormatter"
	SOAPFormatter               = "SOAPFormatter"
	SOAPFormatterWithExceptions = "SOAPFormatterWithExceptions"
)

Variables

View Source
var BinaryTypeEnumerationMap = map[string]int{
	"Primitive":      0,
	"String":         1,
	"Object":         2,
	"SystemClass":    3,
	"Class":          4,
	"ObjectArray":    5,
	"StringArray":    6,
	"PrimitiveArray": 7,
}

Binary type information that is used to define the type of each member of the class being defined.

View Source
var PrimitiveTypeEnum = map[string]int{
	"Boolean": 1,
	"Byte":    2,
	"Char":    3,

	"Decimal":  5,
	"Double":   6,
	"Int16":    7,
	"Int32":    8,
	"Int64":    9,
	"SByte":    10,
	"Single":   11,
	"TimeSpan": 12,
	"DateTime": 13,
	"UInt16":   14,
	"UInt32":   15,
	"UInt64":   16,
	"Null":     17,
	"String":   18,
}

The Primitive Type, must be added to additionalInfo array for each primitive class member that was defined in MemberTypes for a given object. https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/4e77849f-89e3-49db-8fb9-e77ee4bc7214

View Source
var RecordTypeEnumMap = map[string]int{
	"SerializedStreamHeader":         0,
	"ClassWithId":                    1,
	"SystemClassWithMembers":         2,
	"ClassWithMembers":               3,
	"SystemClassWithMembersAndTypes": 4,
	"ClassWithMembersAndTypes":       5,
	"BinaryObjectString":             6,
	"BinaryArray":                    7,
	"MemberPrimitiveTyped":           8,
	"MemberReference":                9,
	"ObjectNull":                     10,
	"MessageEnd":                     11,
	"BinaryLibrary":                  12,
	"ObjectNullMultiple256":          13,
	"ObjectNullMultiple":             14,
	"ArraySinglePrimitive":           15,
	"ArraySingleObject":              16,
	"ArraySingleString":              17,
	"MethodCall":                     21,
	"MethodReturn":                   22,
}

Serialized objects are basically classes that are defined by a series of RecordTypes. All existing record types are defined here though all are not used for our purposes. ref https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/954a0657-b901-4813-9398-4ec732fe8b32

Functions

func CreateAxHostStateDLL added in v1.47.0

func CreateAxHostStateDLL(dllBytes []byte, formatter string) (string, bool)

func CreateClaimsPrincipal added in v1.45.0

func CreateClaimsPrincipal(program string, args string, formatter string) (string, bool)

func CreateDLLReflection added in v1.47.0

func CreateDLLReflection(dllBytes []byte, formatter string) (string, bool)

Serves a DLL in memory, used by CreateAxHostStateDLL

func CreateDataSet added in v1.45.0

func CreateDataSet(program string, args string, formatter string) (string, bool)

func CreateDataSetTypeSpoof added in v1.45.0

func CreateDataSetTypeSpoof(program string, args string, formatter string) (string, bool)

func CreateDataSetXMLDiffGram added in v1.47.0

func CreateDataSetXMLDiffGram(payloadIn string) (string, bool)

func CreateObjectDataProvider added in v1.45.0

func CreateObjectDataProvider(program string, args string, formatter string) (string, bool)

ObjectDataProvider.

func CreateObjectRef added in v1.46.0

func CreateObjectRef(url string, formatter string) (string, bool)

func CreateTextFormattingRunProperties added in v1.45.0

func CreateTextFormattingRunProperties(program string, args string, formatter string) (string, bool)

func CreateTypeConfuseDelegate added in v1.45.0

func CreateTypeConfuseDelegate(program string, args string, formatter string) (string, bool)

TypeConfuseDelegate.

func CreateVeeamCryptoKeyInfo added in v1.45.0

func CreateVeeamCryptoKeyInfo(url string, formatter string) (string, bool)

func CreateViewstatePayload added in v1.45.0

func CreateViewstatePayload(payloadData string, machineKey string, generator string) (string, bool)

Takes payloadData, a machineKey, and a generator (can be empty) and returns a base64 encoded, signed payload. payloadData should be a dotnet serialized payload.

func CreateWindowsIdentity added in v1.45.0

func CreateWindowsIdentity(program string, args string, formatter string) (string, bool)

func FormatLOS added in v1.45.0

func FormatLOS(input string) string

func FormatSOAPWithExceptions added in v1.46.0

func FormatSOAPWithExceptions(records []Record) (string, bool)

used for rogue reporting server SOAP messages.

func GenerateViewstateHMAC added in v1.46.0

func GenerateViewstateHMAC(data string, algo string, hexKey string) (string, bool)

func GeneratorToArray added in v1.46.0

func GeneratorToArray(input string) ([]byte, bool)

hex decode the generator and 'fix the endianness', a.k.a reverse the bytes since this is basically always going to be the same.

func IsValidXML added in v1.45.0

func IsValidXML(data []byte) bool

func ReadGadget

func ReadGadget(gadgetName, formatter string) ([]byte, error)

ReadGadget reads a gadget chain file by gadget name and formatter.

func TextFormattingRunPropertiesBinaryFormatter

func TextFormattingRunPropertiesBinaryFormatter(cmd string) string

TextFormattingRunPropertiesBinaryFormatter serializes a TextFormattingRunProperties gadget chain using the BinaryFormatter formatter.

Types

type ArrayInfo added in v1.45.0

type ArrayInfo struct {
	ObjectID    int
	MemberCount int
}

type ArraySingleObjectRecord added in v1.47.0

type ArraySingleObjectRecord struct {
	ArrayInfo ArrayInfo
	Members   []any
}

func (ArraySingleObjectRecord) GetRecordType added in v1.47.0

func (arraySingleObjectRecord ArraySingleObjectRecord) GetRecordType() int

func (ArraySingleObjectRecord) ToRecordBin added in v1.47.0

func (arraySingleObjectRecord ArraySingleObjectRecord) ToRecordBin() (string, bool)

func (ArraySingleObjectRecord) ToXML added in v1.47.0

func (arraySingleObjectRecord ArraySingleObjectRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type ArraySinglePrimitiveRecord added in v1.45.0

type ArraySinglePrimitiveRecord struct {
	PrimitiveTypeEnum int
	ArrayInfo         ArrayInfo
	Members           string // this will be a hex byte string "\x00\xwhatever"
}

func (ArraySinglePrimitiveRecord) GetRecordType added in v1.45.0

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) GetRecordType() int

func (ArraySinglePrimitiveRecord) ToRecordBin added in v1.45.0

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) ToRecordBin() (string, bool)

func (ArraySinglePrimitiveRecord) ToXML added in v1.46.0

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

func (ArraySinglePrimitiveRecord) ToXMLBespoke added in v1.46.0

func (arraySinglePrimitiveRecord ArraySinglePrimitiveRecord) ToXMLBespoke() (ClassDataNode, bool)

This one is different from the other recordbecause it usually is not processed within the 'context' of the member values, and needs to be called with information that is not present. These records are usually appended outside of the membervalues.

type ArraySingleStringRecord added in v1.45.0

type ArraySingleStringRecord struct {
	ArrayInfo ArrayInfo
	Members   []any
}

func (ArraySingleStringRecord) GetRecordType added in v1.45.0

func (arraySingleStringRecord ArraySingleStringRecord) GetRecordType() int

func (ArraySingleStringRecord) ToRecordBin added in v1.45.0

func (arraySingleStringRecord ArraySingleStringRecord) ToRecordBin() (string, bool)

ToRecordBin impls these exist to convert the struct into the binary stream that is expected by the serialized object format.

func (ArraySingleStringRecord) ToXML added in v1.46.0

func (arraySingleStringRecord ArraySingleStringRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type BinaryArrayRecord added in v1.47.0

type BinaryArrayRecord struct {
	ObjectID            int
	BinaryArrayTypeEnum int // 1byte
	Rank                int
	Lengths             []int
	LowerBounds         []int
	TypeEnum            int // 1byte
	AdditionalTypeInfo  []any
}

func (BinaryArrayRecord) GetRecordType added in v1.47.0

func (binaryArrayRecord BinaryArrayRecord) GetRecordType() int

func (BinaryArrayRecord) ToRecordBin added in v1.47.0

func (binaryArrayRecord BinaryArrayRecord) ToRecordBin() (string, bool)

func (BinaryArrayRecord) ToXML added in v1.47.0

func (binaryArrayRecord BinaryArrayRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type BinaryLibraryRecord added in v1.45.0

type BinaryLibraryRecord struct {
	ID      int
	Library string
}

func (BinaryLibraryRecord) GetRecordType added in v1.45.0

func (binaryLibraryRecord BinaryLibraryRecord) GetRecordType() int

func (BinaryLibraryRecord) ToRecordBin added in v1.45.0

func (binaryLibraryRecord BinaryLibraryRecord) ToRecordBin() (string, bool)

func (BinaryLibraryRecord) ToXML added in v1.46.0

func (binaryLibraryRecord BinaryLibraryRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type BinaryObjectRecord added in v1.45.0

type BinaryObjectRecord struct {
	ObjectID int
	Value    string
}

func (BinaryObjectRecord) GetRecordType added in v1.45.0

func (binaryObjectRecord BinaryObjectRecord) GetRecordType() int

func (BinaryObjectRecord) ToXML added in v1.46.0

func (binaryObjectRecord BinaryObjectRecord) ToXML(classInfo ClassInfo, memberTypeInfo MemberTypeInfo, _ BinaryLibraryRecord, currentIndex int, _ string) (MemberNode, bool)

type Body added in v1.45.0

type Body struct {
	Classes []any
}

type ClassDataNode added in v1.45.0

type ClassDataNode struct {
	XMLName     xml.Name
	ID          string     `xml:"id,attr"`
	Attrs       []xml.Attr `xml:",attr"`
	Content     string     `xml:",chardata"`
	MemberNodes []any
}

type ClassInfo added in v1.45.0

type ClassInfo struct {
	ObjectID int
	// Needs to be length-prefixed when used
	Name string
	// should match len(MemberNames)
	MemberCount int
	// Exactly what it sounds like.
	MemberNames []string
}

Contains metadata about a class, used for ClassWithMembersAndTypesRecords and SystemClassWithMembersAndTypesRecords.

func (ClassInfo) GetBaseClassName added in v1.45.0

func (classInfo ClassInfo) GetBaseClassName() string

returns only the last item in the class name obj.Name = "Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties" obj.GetLeadingClassName(className) == "TextFormattingRunProperties".

func (ClassInfo) GetLeadingClassName added in v1.45.0

func (classInfo ClassInfo) GetLeadingClassName() string

returns all but the last item in the class name obj.Name = "Microsoft.VisualStudio.Text.Formatting.TextFormattingRunProperties" obj.GetLeadingClassName(className) == "Microsoft.VisualStudio.Text.Formatting".

func (ClassInfo) ToBin added in v1.45.0

func (classInfo ClassInfo) ToBin() string

Gives us the expected expected binary string representation. ref: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/0a192be0-58a1-41d0-8a54-9c91db0ab7bf

type ClassTypeInfo added in v1.45.0

type ClassTypeInfo struct {
	TypeName  string
	LibraryID int
}

Class library metadata, sometimes used as additionalinfo value to define the library a class belongs to. This is used when a Class is a membervalue for another class.

type ClassWithIDRecord added in v1.45.0

type ClassWithIDRecord struct {
	ObjectID     int
	MetadataID   int
	MemberValues []any
}

func (ClassWithIDRecord) GetRecordType added in v1.45.0

func (classWithIDRecord ClassWithIDRecord) GetRecordType() int

func (ClassWithIDRecord) ToRecordBin added in v1.45.0

func (classWithIDRecord ClassWithIDRecord) ToRecordBin() (string, bool)

func (ClassWithIDRecord) ToXML added in v1.46.0

func (classWithIDRecord ClassWithIDRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type ClassWithMembersAndTypesRecord added in v1.45.0

type ClassWithMembersAndTypesRecord struct {
	ClassInfo      ClassInfo
	MemberTypeInfo MemberTypeInfo
	LibraryID      int
	MemberValues   []any
	BinaryLibrary  BinaryLibraryRecord // Not _really_ supposed to be here per MSDN but I placed it here for convenience
}

func (ClassWithMembersAndTypesRecord) GetRecordType added in v1.45.0

func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) GetRecordType() int

func (ClassWithMembersAndTypesRecord) ToRecordBin added in v1.45.0

func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) ToRecordBin() (string, bool)

ref: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/847b0b6a-86af-4203-8ed0-f84345f845b9

func (ClassWithMembersAndTypesRecord) ToXML added in v1.46.0

func (classWithMembersAndTypesRecord ClassWithMembersAndTypesRecord) ToXML(classInfo ClassInfo, _ MemberTypeInfo, binaryLibraryRecord BinaryLibraryRecord, currentIndex int, ns string) (MemberNode, bool)

type MemberNode added in v1.45.0

type MemberNode struct {
	XMLName xml.Name
	ID      string     `xml:"id,attr,omitempty"`
	HREF    string     `xml:"href,attr,omitempty"`
	XsiType string     `xml:"xsi:type,attr,omitempty"`
	XsiNull string     `xml:"xsi:null,attr,omitempty"`
	Content string     `xml:",innerxml"`
	Attrs   []xml.Attr `xml:",attr"`
}

type MemberPrimitiveTypedRecord added in v1.47.0

type MemberPrimitiveTypedRecord struct {
	PrimitiveTypeEnum int
	Value             Primitive
}

func (MemberPrimitiveTypedRecord) GetRecordType added in v1.47.0

func (memberPrimitiveTypedRecord MemberPrimitiveTypedRecord) GetRecordType() int

func (MemberPrimitiveTypedRecord) ToRecordBin added in v1.47.0

func (memberPrimitiveTypedRecord MemberPrimitiveTypedRecord) ToRecordBin() (string, bool)

func (MemberPrimitiveTypedRecord) ToXML added in v1.47.0

func (memberPrimitiveTypedRecord MemberPrimitiveTypedRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type MemberReferenceRecord added in v1.45.0

type MemberReferenceRecord struct {
	IDRef int
}

func (MemberReferenceRecord) GetRecordType added in v1.45.0

func (memberReferenceRecord MemberReferenceRecord) GetRecordType() int

func (MemberReferenceRecord) ToRecordBin added in v1.45.0

func (memberReferenceRecord MemberReferenceRecord) ToRecordBin() (string, bool)

func (MemberReferenceRecord) ToXML added in v1.46.0

func (memberReferenceRecord MemberReferenceRecord) ToXML(classInfo ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, currentIndex int, _ string) (MemberNode, bool)

type MemberTypeInfo added in v1.45.0

type MemberTypeInfo struct {
	BinaryTypeEnums []int
	BinaryTypes     []string // for convenience not part of the 'official' data structure per MSDN
	AdditionalInfos []any
}

Defines the types and additional info about the members themselves. used for ClassWithMembersAndTypesRecords and SystemClassWithMembersAndTypesRecords ref: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/aa509b5a-620a-4592-a5d8-7e9613e0a03e

func (MemberTypeInfo) ToBin added in v1.45.0

func (memberTypeInfo MemberTypeInfo) ToBin() (string, bool)

Gives us the expected expected binary string representation. MemberTypeInfo output order: byteTypeEnums[]byte + []AdditionalInfo.

type ObjectNullMultiple256Record added in v1.47.0

type ObjectNullMultiple256Record struct {
	NullCount int
}

func (ObjectNullMultiple256Record) GetRecordType added in v1.47.0

func (objectNullMultiple256Record ObjectNullMultiple256Record) GetRecordType() int

func (ObjectNullMultiple256Record) ToRecordBin added in v1.47.0

func (objectNullMultiple256Record ObjectNullMultiple256Record) ToRecordBin() (string, bool)

func (ObjectNullMultiple256Record) ToXML added in v1.47.0

func (objectNullMultiple256Record ObjectNullMultiple256Record) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type ObjectNullRecord added in v1.45.0

type ObjectNullRecord struct{}

func (ObjectNullRecord) GetRecordType added in v1.45.0

func (objectNullRecord ObjectNullRecord) GetRecordType() int

func (ObjectNullRecord) ToRecordBin added in v1.45.0

func (objectNullRecord ObjectNullRecord) ToRecordBin() (string, bool)

func (ObjectNullRecord) ToXML added in v1.46.0

func (objectNullRecord ObjectNullRecord) ToXML(classInfo ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, currentIndex int, _ string) (MemberNode, bool)

type Primitive added in v1.45.0

type Primitive interface {
	PrimToString() string
}

Primitives are a data type that can be one of a few different types. This implemented has been implementede on the ones that we have used so far. These are generally added as additionalinfo when there is a BinaryTypeEnum value passed as a member type for Primitive.

type PrimitiveByte added in v1.45.0

type PrimitiveByte byte

func (PrimitiveByte) PrimToString added in v1.45.0

func (me PrimitiveByte) PrimToString() string

type PrimitiveByteString added in v1.47.0

type PrimitiveByteString string

func (PrimitiveByteString) PrimToString added in v1.47.0

func (me PrimitiveByteString) PrimToString() string

A placeholder for lesser-used objects such as Single Whatever you give it, will be placed in the stream exactly as given Can't just pass a string because it will get 'processed' as a lengthPrefixedString, this avoids that.

type PrimitiveInt16 added in v1.45.0

type PrimitiveInt16 int

func (PrimitiveInt16) PrimToString added in v1.45.0

func (me PrimitiveInt16) PrimToString() string

type PrimitiveInt32 added in v1.45.0

type PrimitiveInt32 int

func (PrimitiveInt32) PrimToString added in v1.45.0

func (me PrimitiveInt32) PrimToString() string

type Record added in v1.45.0

type Record interface {
	GetRecordType() int
	ToRecordBin() (string, bool)
	// TOXML impls, exist to convert a given record into the expected SOAP XML element for the SOAP formatter. Not all records have been implemented.
	ToXML(ClassInfo, MemberTypeInfo, BinaryLibraryRecord, int, string) (MemberNode, bool)
}

type SOAPEnvelope added in v1.45.0

type SOAPEnvelope struct {
	XMLName xml.Name `xml:"SOAP-ENV:Envelope"` // Specify the XML name with namespace
	Body    Body     `xml:"SOAP-ENV:Body"`     // Nested struct for Body

	Xsi           string `xml:"xmlns:xsi,attr"`
	Xsd           string `xml:"xmlns:xsd,attr"`
	SoapEnc       string `xml:"xmlns:SOAP-ENC,attr"`
	SoapEnv       string `xml:"xmlns:SOAP-ENV,attr"`
	Clr           string `xml:"xmlns:clr,attr"`
	EncodingStyle string `xml:"SOAP-ENV:encodingStyle,attr"`
}

func FormatSOAP added in v1.45.0

func FormatSOAP(records []Record) (string, SOAPEnvelope, bool)

type SerializationHeaderRecord added in v1.45.0

type SerializationHeaderRecord struct {
	HeaderID int
	RootID   int
}

func (SerializationHeaderRecord) GetRecordType added in v1.45.0

func (serializationHeaderRecord SerializationHeaderRecord) GetRecordType() int

func (SerializationHeaderRecord) ToRecordBin added in v1.45.0

func (serializationHeaderRecord SerializationHeaderRecord) ToRecordBin() (string, bool)

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/a7e578d3-400a-4249-9424-7529d10d1b3c

func (SerializationHeaderRecord) ToXML added in v1.46.0

func (serializationHeaderRecord SerializationHeaderRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

type SystemClassWithMembersAndTypesRecord added in v1.45.0

type SystemClassWithMembersAndTypesRecord struct {
	ClassInfo      ClassInfo
	MemberTypeInfo MemberTypeInfo
	MemberValues   []any
}

func (SystemClassWithMembersAndTypesRecord) GetRecordType added in v1.45.0

func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord) GetRecordType() int

func (SystemClassWithMembersAndTypesRecord) ToRecordBin added in v1.45.0

func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord) ToRecordBin() (string, bool)

func (SystemClassWithMembersAndTypesRecord) ToXML added in v1.46.0

func (systemClassWithMembersAndTypesRecord SystemClassWithMembersAndTypesRecord) ToXML(_ ClassInfo, _ MemberTypeInfo, _ BinaryLibraryRecord, _ int, _ string) (MemberNode, bool)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL