OOXML (Office Open XML) is a file format developed by Microsoft for office documents, based on ZIP and XML. In practice, all Word and Excel files are therefore zipped XML, which means that OOXML processors may also be vulnerable to XML attacks, such as XXE.

Start the exercise below and continue reading.

Did you know that Office documents are just zipped XML?

In this lab, you exploit the XXE vulnerability in the Excel import function.

XXE OOXML 1

Download the sample order from the lab's address "/static/order.xlsx", open the attacker's code editor, and then drag and drop the file into the /root directory.

Start the terminal by selecting the hamburger menu in the code editor -> terminal -> new terminal. Go to the /root directory if you are not already there.

Run the ls command and you should see that "order.xlsx" is there.

As already mentioned, Excel files are simply zipped XML files. Create a directory named "order" and use the unzip command to extract the file into the directory.

Let's create a small shell script now that we can use to repack Excel. Right-click on the root directory, select "new file" and give it the name "repackage.sh". Enter the following text:

Then download the generated evil.xlsx file. You can do this by right-clicking on 'evil.xlsx' in the code editor and selecting "Download".

Return now to the pizza service, download the order, and confirm that the order works. Now we have a working foundation for building the attack.

In order to achieve reflected XXE, we need to determine where in the Excel file the words "Mozzarella" and "Salami" can be found. We can use the 

It seems that "order/xl/sharedStrings.xml" is the correct file. Open this file in the code editor.

By now, you should already know how to proceed from here. If this step doesn't feel familiar, go back to the previous modules in this course.

Create a DTD entity that points to the /secret-recipe.txt file, and then execute that entity instead of Mozzarella or Salami.

And the syntax of the external entity is:

And the syntax for executing the entity is:

## What is OOXML?

OOXML (Office Open XML) is a file format developed by Microsoft for office documents, based on ZIP and XML. In practice, all Word and Excel files are therefore zipped XML, which means that OOXML processors may also be vulnerable to XML attacks, such as XXE.

---

## Practical example

Start the exercise below and continue reading.

@exercise 3d85b51420f4

---

## Model order

Download the sample order from the lab's address "/static/order.xlsx", open the attacker's code editor, and then drag and drop the file into the /root directory.

![](sanity:image-d5e5c6762bcde54f5fb09466c6d7d741c83a46c5-1030x885-png)

---

## Terminal

Start the terminal by selecting the hamburger menu in the code editor -> terminal -> new terminal. Go to the /root directory if you are not already there.

![](sanity:image-24db64fe3748ab553fd74d0953dd6091519adaa1-1040x518-png)

```sh
cd /root
```

Run the ls command and you should see that "order.xlsx" is there.

```sh
see
CachedExtensions Machine User coder.json extensions logs machineid order.xlsx web
```

---

## Extract Excel

As already mentioned, Excel files are simply zipped XML files. Create a directory named "order" and use the unzip command to extract the file into the directory.

```sh
mkdir order
unzip order.xlsx -d order
```

![](sanity:image-7d7a0cfabfc83ad68c51c5915203bddc9236d176-993x542-png)

---

## Repackaging script

Let's create a small shell script now that we can use to repack Excel. Right-click on the root directory, select "new file" and give it the name "repackage.sh". Enter the following text:

```sh
#!/bin/bash
(cd order && zip -r /root/evil.xlsx ./*)
```

Grant execution rights to the script:

```sh
chmod +x ./repackage.sh
```

---

## Test settings

Try that the repackaging script works.

![](sanity:image-8ee70112c5d602c765f9107c66a60c7d703a28df-1004x717-png)

Then download the generated evil.xlsx file. You can do this by right-clicking on 'evil.xlsx' in the code editor and selecting "Download".

Return now to the pizza service, download the order, and confirm that the order works. Now we have a working foundation for building the attack.

![](sanity:image-6bd722505e1a9a57d6705e95bed89250ef76e87b-1632x1109-png)

---

## Search location

In order to achieve reflected XXE, we need to determine where in the Excel file the words "Mozzarella" and "Salami" can be found. We can use the **grep** command to find this out.

```sh
grep -r Mozzarella ./order
```

![](sanity:image-565815c6bdfb5780fa793eff85872fcbdd854ec5-1041x241-png)

It seems that "order/xl/sharedStrings.xml" is the correct file. Open this file in the code editor.

---

## XXE

By now, you should already know how to proceed from here. If this step doesn't feel familiar, go back to the previous modules in this course.

Create a DTD entity that points to the /secret-recipe.txt file, and then execute that entity instead of Mozzarella or Salami.

As a reminder, the syntax for DTD is:

```xml
<!DOCTYPE root [ ]>
```

And the syntax of the external entity is:

```xml
<!ENTITY name SYSTEM "url or path">
```

And the syntax for executing the entity is:

```xml
&name;
```


XXE in Excel and Word Files (OOXML)

XML is superficially a simple protocol, tags and attributes. However, XML has hidden capabilities that unfortunately are often not disabled by default in XML handlers...

XML is a relatively simple protocol, consisting of tags and attributes. However, XML has hidden abilities that unfortunately are often not disabled by default in XML processors...

XXE in Excel and Word Files (OOXML)

What is OOXML?

Learn to hack — start here