I have an IIS web server on which I installed Miktex distribution.

I host a site that allows users to submit LaTeX input codes. The server then compiles the input using pdflatex.exe to produce a pdf file.

For those who understand C#, here is the code snippet:

    Process p = new Process();

    p.EnableRaisingEvents = true;
    p.Exited += new EventHandler(p_Exited);

    p.StartInfo.Arguments = "-interaction=nonstopmode " + inputpath;
    p.StartInfo.WorkingDirectory = @"c:\mydomain.com\working";

    p.StartInfo.UseShellExecute = false;
    p.StartInfo.FileName = "pdflatex.exe";


My site runs under ApplicationPoolIdentity with Load User Profile = True. As far as I know, this account has less privilege.

Shortly speaking, I want to test this server by submitting a dangerous input file.

Could you give me a working, dangerous LaTeX input file to test the vulnerability of my server?

Note: Please don't use javascript and HTML because I am not interested to think of XSS and XSRF now.

1 Answer 1


Why not try the one given in Listing 1? It's not complete, but the only part missing is 11 lines of the JScript it runs at next login.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.