PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc ....
9
Advanced XXE Exploitation Exercise 3: PHP filter encoding (App port 8023) Philippe Arteau GoSecure Countertack 19/06/2019 Slides: http://bit.ly/xxeparis
Transcript of PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc ....
![Page 1: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/1.jpg)
Advanced XXE ExploitationExercise 3: PHP filter encoding (App port 8023)
Philippe ArteauGoSecure Countertack
19/06/2019Slides: http://bit.ly/xxeparis
![Page 2: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/2.jpg)
![Page 3: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/3.jpg)
Allow the extraction of binary file
SVN metadata(older version : .svn/entries)
![Page 4: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/4.jpg)
1. Ctrl-Shift-B
2. Grep or Open in SQLite Other file versionned
![Page 5: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/5.jpg)
Use the same method use to read SVN metadata to read this PHP file
![Page 6: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/6.jpg)
![Page 7: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/7.jpg)
![Page 8: PHP filter encoding2019/06/19 · atom in a few seconds Edit View Language Logout / .svn/wc . Control Panel XML File 2 4 6 16 feed [ xxe SYSTEM < feed> " php: / / filter/ convert.](https://reader033.fdocuments.net/reader033/viewer/2022060705/607148cc9f7585546f686e4e/html5/thumbnails/8.jpg)
Can you find how to get RCE using the PHP script?