I have an IIS web server on which I installed Miktex distribution.
I host a site that allows users to submit LaTeX input codes. The server then compiles the input using
pdflatex.exe to produce a pdf file.
For those who understand C#, here is the code snippet:
Process p = new Process(); p.EnableRaisingEvents = true; p.Exited += new EventHandler(p_Exited); p.StartInfo.Arguments = "-interaction=nonstopmode " + inputpath; p.StartInfo.WorkingDirectory = @"c:\mydomain.com\working"; p.StartInfo.UseShellExecute = false; p.StartInfo.FileName = "pdflatex.exe"; p.Start(); p.WaitForExit();
My site runs under
Load User Profile = True. As far as I know, this account has less privilege.
Shortly speaking, I want to test this server by submitting a dangerous input file.
Could you give me a working, dangerous LaTeX input file to test the vulnerability of my server?