From XSLT code execution to Meterpreter shells

From: Nicolas =?ISO-8859-1?Q?Gr=E9goire?= <nicolas.gregoire@agarri.fr>
To: bugtraq@securityfocus.com
Cc:
Subject: From XSLT code execution to Meterpreter shells
Date:


Hello,

in the last weeks, I demonstrated at HackInTheBox Amsterdam and
HackInParis a Metasploit module used to gain Meterpreter shells from
XSLT vulnerabilities.

Given the questions I received, I chose to publish a blog-post
explaining the overall concept and some implementation details. The
article is available here: http://www.agarri.fr/blog/

The vulnerable PHP and JSP applications used during the talk are
included. Furthermore, the video of the HackInTheBox talk is online:
http://www.youtube.com/watch?v=_0mNSAbsRaU

Regards,
Nicolas Grégoire





Copyright © 1995-2019 LinuxRocket.net. All rights reserved.