Thanks to this tweet [https://twitter.com/phithon_xg/status/1073845338606194689?s=20](https://twitter.com/phithon_xg/status/1073845338606194689?s=20), I know that we can put the dtd with parameter entity right in the xml file.
So I extracted the flag through DNS using [http://dnsbin.zhack.ca/](http://dnsbin.zhack.ca/)
Upload [this](https://pastebin.com/raw/SJrs3st1) xml and a query will come to dnsbin containing the flag.