[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

From XSLT code execution to Meterpreter shells


in the last weeks, I demonstrated at HackInTheBox Amsterdam and
HackInParis a Metasploit module used to gain Meterpreter shells from
XSLT vulnerabilities.

Given the questions I received, I chose to publish a blog-post
explaining the overall concept and some implementation details. The
article is available here: http://www.agarri.fr/blog/

The vulnerable PHP and JSP applications used during the talk are
included. Furthermore, the video of the HackInTheBox talk is online:

Nicolas GrÃgoire