We've added a new demo to NewRemotingTricks that makes deploying a MarshalByRefObject (e.g., WebClient) even easier: System.Lazy<T> creates an instance of T on serialization, which is probably more likely to be allowed than a XAML gadget getting through. https://github.com/codewhitesec/NewRemotingTricks
GitHub - codewhitesec/NewRemotingTricks: New exploitation tricks for hardened .NET Remoting servers

New exploitation tricks for hardened .NET Remoting servers - codewhitesec/NewRemotingTricks

GitHub