Collected research
Getting Shell with XAMLX Files
Uploading a .XAMLX workflow-service file to an IIS application runs code, either through XAML deserialisation gadgets wrapped in an Array element at compile time or through inline C# and expression activities evaluated when the file is requested. A payload can break out of the generated method into the class body, and a web.config can register the handler where it is missing.
Record
- Researcher
- Soroush Dalili
- Published by
- soroush.me
- Format
- Whitepaper
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Soroush Dalili, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .