Machine - Glider

This is a machine I have completed in the past with an XXE / XEE XML External Entity

demo.php

When filling out the form box at /demo.php we are able to do XEE / XML related attack

using HackTricks we are able to get the /etc/passwd file to display

We are also able to obtain the users flag steven

We can use this to look at source code of the webpage using php filters and converting to base64

Read the src luke

The payload

<!DOCTYPE replace [<!ENTITY example SYSTEM "php://filter/convert.base64-encode/resource=/var/www/html/demo.php"> ]>

<users><name>&example;</name>

copy and paste the output to a file:

cat demo.b64| base64 -d > demo.php

The Plan

We will be using python to get back the base64 of the source code of the web page

Libraries

• base64
• requests
• beautifulsoup
• argparse