Take the 2-minute tour ×
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It's 100% free, no registration required.

I have an IIS web server on which I installed Miktex distribution.

I host a site that allows users to submit LaTeX input codes. The server then compiles the input using pdflatex.exe to produce a pdf file.

For those who understand C#, here is the code snippet:

    Process p = new Process();

    p.EnableRaisingEvents = true;
    p.Exited += new EventHandler(p_Exited);

    p.StartInfo.Arguments = "-interaction=nonstopmode " + inputpath;
    p.StartInfo.WorkingDirectory = @"c:\mydomain.com\working";

    p.StartInfo.UseShellExecute = false;
    p.StartInfo.FileName = "pdflatex.exe";

    p.Start();
    p.WaitForExit();

My site runs under ApplicationPoolIdentity with Load User Profile = True. As far as I know, this account has less privilege.

Shortly speaking, I want to test this server by submitting a dangerous input file.

Could you give me a working, dangerous LaTeX input file to test the vulnerability of my server?

Note: Please don't use javascript and HTML because I am not interested to think of XSS and XSRF now.

share|improve this question
add comment

1 Answer

up vote 7 down vote accepted

Why not try the one given in Listing 1? It's not complete, but the only part missing is 11 lines of the JScript it runs at next login.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.