SOAP

SOAP

CHALLENGE AUTHOR: GEOFFREY NJOGU

Description The web project was rushed and no security assessment was done. Can you read the /etc/passwd file? Web Portal

Solution

Well this challenge reminded me of LFI (local File Inclusion). It was an interesting challenge, I loved it. Let’s get started, shall we?

1. Connect to the challenge via the provided url.
2. It looks very much static, I try the Detail buttons to check what they load and I proxy my requests through burp.
3. We get a path /data that appends an xml code snippet with the id parameter.
4. I immediately start crafting xml PoCs to dump the /etc/passwd
5. I come up with

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY readfile SYSTEM "file:///etc/passwd">
]>
<data>
  <ID>&readfile;</ID>
</data>

1. I remove the existing xml and replace it with my crafted xml.
2. Sending the request, we get a response dumping the /etc/passwd and at the end of it we get our flag.

That is it. Stay vigilant in the digital wild west. Happy Hacking