W-DESER-NETExecution

Deserialization — .NET BinaryFormatter / JSON.NET

TypeNameHandling.All in JSON.NET, BinaryFormatter, ObjectStateFormatter (ViewState) — ysoserial.net gadgets reach Process.Start.

§ Where this technique fits

W-DESER-NET is catalogued under the Execution tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

MOVEit Transfer (CVE-2023-34362) → mass data exfil (Cl0p)
Pre-auth SQLi in MOVEit's web UI forges an admin session. .NET deserialisation chain drops a webshell as SYSTEM. Cl0p's 2023 mass-exfil playbook: download every file under /var/files.
step 3 / 6

§ What commonly comes next

01
Webshell Deployment
W-WEBSHELL · Persistence
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MOVEit Transfer (CVE-2023-34362) → mass data exfil (Cl0p)

§ What commonly comes next