Number four on the 0 lost top 10 list is what are called X AML external entities.
Now this is also known as an x x e attack.
So what is x x.
Well execs he abuses systems or attack systems that pass x amount input.
So where you're going to see here in our example in the next video is that we're going to take x AML
input and get malicious with it.
We're going to upload it into a upload file a feature and it's going to try to pass that x amount input
and then we're gonna be able to do malicious code with that x amount input and get some information
out of the system that we're attacking and this will all make sense here in just a minute because of
this we're going to be abusing what's called a system and to see when we talk about X AML here in a
minute you'll see what that means and how we can get malicious with it.
And lastly the attacks that we can do include denial service local file disclosure which is what we're
gonna be doing.
Remote code execution and much more.
All right.
So let's say that I want to write out this X AML document and I just kind of want to cover the basics
of X and mail first so that you can understand why this attack is going to work and what we're doing
with it exactly.
So let's start by writing this out up at the top I'm just going to type this out here the X and meld
version and what this is is what's called our metadata.
Now you don't always need this but I always like to include it at the top.
So if you go ahead and just follow along and if you need to pause at any time while I'm typing this
out please feel free.
I am going to try to talk slow in type fast.
That way you can follow along and have opportunities to catch up so at the very top.
We've declared that this is an Excel document and what we're gonna do with that is we're just putting
this this header here we're saying hey the versions 1.0 here's our encoding and then we're going to
need to declare what is called a root element.
So we have elements.
OK.
And so we're just going to say gift in this situation we're giving out a gift.
OK.
So here is our root element and I'm going to do just like this.
And if you've ever used H Tim Al before all you gotta do is close off your tags here.
So you've got this gift and then we're gonna say slash gift to end this element.
So up here we're gonna go ahead and just hit a tab and let's say that we're giving out a gift and to
give out that gift.
We're going to need to say Hey we're gonna do two and I'm doing this gift idea because if you see the
top it is December 21st it's almost 1:00 a.m. here so it's really close to Christmas or whatever holiday
that you celebrate.
So I thought this would be a good idea.
So we're going to give this gift to our buddy Frank.
We we did him dirty in the 80 section we owned his account he had bad passwords.
Let's give him something nice to say thank you.
And we're going to say from you go ahead put your name in here close off from and then we're gonna go
ahead and just give him an item so that I don't I'm going to give him is Pokemon cards because who doesn't
love Pokemon cards right.
So we have the gift which is our root element.
These are what is called our children elements.
OK.
So remember that we have root and children now let's say we're in a situation where I've got a lot of
gifts I want to give and I don't want to have to type this over and over and over again.
Well then we can use something that's called an entity which is basically like it's like a variable.
So let's go ahead and take a look at that entity.
So to add an entity we're going to say something like this.
We're going to declare a dog type up here and we're just going to call a gift and we're going to say
entity from heat.
And this will make sense in just a second.
So go ahead and copy that out.
So what I'm going to do here is I'm saying hey I have an entity and I want to call that and when I call
that I want to go ahead and place he there.
So again like a variable right wherever we call the variable that is just going to place there.
So we're gonna say from like this OK.
So we have Ampersand from and then semicolon in that calls it now why is this.
Also interesting what what is this doing for us.
So a couple things here to point out this.
What we have here this dock type is what is called a document type definition that is a d t d you will
hear that again d d.
So we are declaring this entity within the DVD here.
Now we have a lot of gifts to give away.
We can use from repeatedly right.
Well let's say we're in a situation.
I'm just going to add some spaces in here where we don't have from.
But instead we just had something like Heath and maybe there was you know another person like Amber
that I wanted you know that the gift was from multiple people multiple people.
Right.
So I could say Heath plus Amber Heath and Amber Keith slash Amber.
Well the thing here is if we had just that in here that's not going to work out for us.
These characters are a lot of these are just forbidden characters.
So we can put in you know alphanumeric but when it comes to these special characters it kind of gets
funky.
And imagine if we wanted a special character like I don't know a greater than symbol or less than symbol.
What's that going to do to our code that's going to mess things up.
So what we can do is we can use these entities to call things down.
So if I put in here and I said Heath and Amber guess what.
That would actually bring down as long as I declared it here and I said from.
So not only does it work as a variable but it allows us to include other items write special characters.
And if you're mind spinning you've got that attack thought process.
What does that mean.
Well that means that we can add things in like I don't know forward slashes maybe try to grab a file
maybe a colon in there to something I know something along the lines of like C slash maybe try to give
a file out.
Right.
So let's take a look at something here.
I'm going to show you a payload so let's go out to Google and I'm just gonna say Google and then I'm
going to say x x e payloads.
Now I do this with a lot of stuff by the way.
You're going to see me do this over and over.
I love to just go look up payloads because there's so many things out there and I can't remember everything.
So I open up a couple of these let's look at the payloads all the things here and just kind of scroll
through it.
And what I'm looking for is the classic X XY that's what we're after here.
So the file system that we're attacking is either going to be Linux or it's going to be windows we are
after a Linux system.
Why.
Because we're running on Docker right.
Are on our lending system.
So we're gonna run in Docker on our clinic system and we're going to attack the Etsy password.
So what we're gonna do here is worse is copy this one down and I'm going to copy this one and actually
let's copy.
Let's copy the second one this looks more like what we did before.
Let's copy the second one and I'm just going to delete all this out of here and I'm in a paste as it
so this looks familiar.
Right.
Exactly what we just did.
We have our doc type and we declare an element inside the DTV OK and then we also have an entity X XY
and we're calling out the system here.
So before we were declaring We were just you know saying hey it's Heath entity from Heath.
Right well here we're adding a little bit extra we're saying system and system is a key word use in
an entity to let the parser know that the resource is external and should be stored inside the entity.
OK.
So this allows us to put this kind of content here maliciously into it.
What also does system do.
Well it allows us to pull data from the system.
So what we're trying to do is we're saying hey entity x x e system and then go ahead and pull the Etsy
password file let's try that and then so when we have here we have our child and we call out foo or
element that we call out foo.
Then we're going to say hey I want you to go ahead and put in here the X XY which is going to just be
a place holder for a system file Etsy password now.
Hopefully that all makes sense in the next video.
We're gonna go ahead and take this.
We're going to get malicious with this and actually attack the upload and see how this pulls down for
us.
So let's go ahead and move onto the next video where we actually exploit exactly.