XSL Transform
It’s beneficial to prepare
multiple bypasses in the event one is blocked.
In this section, we’ll demonstrate a second way
of obtaining arbitrary Jscript execution
while bypassing AppLocker through XSL transformation.
The process of XXL transformation or XSLT
uses Extensible Stylesheet Language (.xsl) documents to
transform an XML document into a different format such as XHTML.
Part of the XSL transformation specification allows execution
of embedded Jscript code
when processing the supplied XML document.
Security researchers have discovered an XSL transformation
attack that allows arbitrary code execution when triggered.
To leverage this, we must first craft a malicious XSL document
and put it on our Apache webserver.
As a proof of concept, we're going to launch a command prompt
Once the file is created, we must download it
and invoke a transform to trigger the Jscript code.
This may be done through the WMI command-line utility,
by specifying the verb get,
and the /format: switch followed by the URL of the XSL file.
Once the command is executed from a command prompt,
a new command prompt is opened,
proving that our Jscript code executed.
This application whitelisting technique can also be leveraged
through a shortcut file that we provide to the victim.
To weaponize this, we can modify the Jscript code inside
the XSL file to contain a DotNetToJscript C#
shellcode runner or any other payload we desire.