# XSLT 服务器端注入（可扩展样式表语言转换）
{{#include ../banners/hacktricks-training.md}}
## 基本信息
XSLT 是一种用于将 XML 文档转换为不同格式的技术。它有三个版本：1、2 和 3，其中版本 1 是最常用的。转换过程可以在服务器上或浏览器中执行。
最常用的框架包括：
- **Libxslt** 来自 Gnome，
- **Xalan** 来自 Apache，
- **Saxon** 来自 Saxonica。
要利用与 XSLT 相关的漏洞，必须将 xsl 标签存储在服务器端，然后访问该内容。以下来源记录了此类漏洞的示例：[https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/)。
## 示例 - 教程
```bash
sudo apt-get install default-jdk
sudo apt-get install libsaxonb-java libsaxon-java
```
```xml:xml.xml
CD Title
The artist
Da Company
10000
1760
```
```xml:xsl.xsl
The Super title
```
执行：
```xml
saxonb-xslt -xsl:xsl.xsl xml.xml
Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
The Super title
| Title |
artist |
| CD Title |
The artist |
```
### 指纹
```xml:detection.xsl
Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
```
执行
```xml
$saxonb-xslt -xsl:detection.xsl xml.xml
Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
XSLT identification
Version:2.0
Vendor:SAXON 9.1.0.8 from Saxonica
Vendor URL:http://www.saxonica.com/
```
### 读取本地文件
```xml:read.xsl
```
```xml
$ saxonb-xslt -xsl:read.xsl xml.xml
Warning: at xsl:stylesheet on line 1 column 111 of read.xsl:
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
```
### SSRF
```xml
```
### 版本
根据使用的 XSLT 版本，可能会有更多或更少的功能：
- [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/)
- [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/)
- [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/)
## 指纹
上传此文件并获取信息
```xml
Version:
Vendor:
Vendor URL:
Product Name:
Product Version:
Is Schema Aware ?:
Supports Serialization:
Supports Backwards Compatibility:
```
## SSRF
```xml
```
## Javascript 注入
```xml
```
## 目录列表 (PHP)
### **Opendir + readdir**
```xml
-
-
-
-
-
-
-
-
-
```
### **断言 (var_dump + scandir + false)**
```xml
```
## 读取文件
### **内部 - PHP**
```xml
```
### **内部 - XXE**
```xml
]>
&ext_file;
```
### **通过 HTTP**
```xml
```
```xml
]>
&passwd;
```
### **内部 (PHP函数)**
```xml
```
```xml
```
### 端口扫描
```xml
```
## 写入文件
### XSLT 2.0
```xml
Write Local File
```
### **Xalan-J 扩展**
```xml
Write Local File
```
在PDF中写入文件的其他方法
## 包含外部XSL
```xml
```
```xml
```
## 执行代码
### **php:function**
```xml
```
```xml
```
执行代码使用其他框架在 PDF 中
### **更多语言**
**在此页面中，您可以找到其他语言中的 RCE 示例：** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET) **（C#、Java、PHP）**
## **从类中访问 PHP 静态函数**
以下函数将调用类 XSL 的静态方法 `stringToUrl`：
```xml
```
(示例来自 [http://laurent.bientz.com/Blog/Entry/Item/using_php_functions_in_xsl-7.sls](http://laurent.bientz.com/Blog/Entry/Item/using_php_functions_in_xsl-7.sls))
## 更多有效载荷
- 查看 [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection)
- 查看 [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)
## **暴力破解检测列表**
{{#ref}}
https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt
{{#endref}}
## **参考文献**
- [XSLT_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)
- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)
- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)
{{#include ../banners/hacktricks-training.md}}