ysoserial.net - Deserialization payload generator for a variety of

项目说明

!logo
---
!GitHub CI
![v2]()
![download]()
!stars
!forks

A proof-of-concept 工具 for generating payloads that exploit unsafe .NET object deserialization.

Description

ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET applications performing unsafe deserialization of objects. The main dri takes a user-specified command and wraps it in the user-specified gadget chain, then serializes these objects to stdout. When an application with the required gadgets on the classpath unsafely deserializes this data, the chain will automatically be invoked and cause the command to be executed on the application host.

It should be noted that the lies in the application performing unsafe deserialization and NOT in having gadgets on the classpath.

This project is inspired by Chris Frohoff's ysoserial project

Disclaimer

This software has been created purely for the purposes of academic research and for the de of effecti techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.

This software is a personal project and not related with any companies, including Project owner and contributors employers.

Installation

In order to obtain the latest , it is recommended to download it from the Actions page.

You can install the previous releases of YSoSerial.NET from the releases page

Build from source:

Windows

Nix

Usage

*Note:* When specifying complex commands, it can be tedious to escape some special character (;, |, &, ..). Use stdin option (-s) to read the command from stdin:

*Note:* XmlSerializer and DataContractSerializer formatters generate a wrapper Xml format including the expected type on the "type" attribute of the root node, as used, for example, in DotNetNuke. You may need to modify the generated xml based on how XmlSerializer gets the expected type in your case.

Plugins

Ysoserial.Net can be used to generate raw payloads or more complex ones using a plugin architecture. To use plugins, use -p <plugin name> followed by the plugin options (the rest of ysoserial.net options will be ignored). Eg:

For more help on plugin options use -h along with -p <plugin name>. Eg:

Examples

Generate a calc.exe payload for Json.Net using *ObjectDataProvider* gadget.

Generate a calc.exe payload for BinaryFormatter using *PSObject* gadget.

Generate a run_command payload for DotNetNuke using its plugin

Generate a read_file payload for DotNetNuke using its plugin

Generate a minified BinaryFormatter payload to exploit Exchange C using the ActiCheck gadget inside the ClaimsPrincipal gadget.

v2 Branch

v2 branch is a copy of ysoserial.net (15/03/2018) that has been changed to work with .NET 框架 2.0 by irsdl. Although this project can be used with applications that use .NET 框架 v2.0, it also requires .NET 框架 3.5 to be installed on the target box as the gadgets depend on it. This problem will be resolved if new gadgets in .NET 框架 2.0 become identified in the future.

Contributing

Fork it

Create your feature branch (git checkout -b my-new-feature)

Commit your changes (git commit -am 'Add some feature')

Push to the branch (git push origin my-new-feature)

Create new Pull Request

Thanks

Special thanks to all contributors:

Oleksandr Mirosh

irsdl

JarLob

DS-Kurt-Boberg

mwulftange

yallie

paralax

Credits

Additional Reading

Attacking .NET serialization

Friday the 13th: JSON Attacks - Slides

Friday the 13th: JSON Attacks - Whitepaper

Friday the 13th: JSON Attacks - Video(demos)

Are you my Type? - Slides

Are you my Type? - Whitepaper

Exploiting .NET Managed DCOM

Exploit Remoting Service

Finding and Exploiting .NET Remoting over HTTP using Deserialisation

.NET Remoting Re

Bypassing .NET Serialization Binders

Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization - Hexacon 2023 Whitepaper

ysoserial.net references in the wild

Research:

Usage:

Talks:

Tools:

CTF write-ups:

项目信息

开发语言：C#

Star 数：3796

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Deserialization payload generator for a of .NET formatters展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。