A great video on exploiting .NET deserialization was presented at Insomni'hack 2018 and can be found on YouTube[1].

[1] https://www.youtube.com/watch?v=eDfGpu3iE4Q