python 模板注入

　　web 程序包括两个文件：

　　flask-test.py 和 Config.py 文件

#!/usr/bin/env python # -*- coding:utf8 -*- import hashlib import logging from datetime import timedelta from flask import Flask from flask import request from flask import config from flask import session from flask import render_template_string from Config import ProductionConfig app = Flask(__name__) handler = logging.StreamHandler() logging_format = logging.Formatter( '%(asctime)s - %(levelname)s - %(filename)s - %(funcName)s - %(lineno)s - %(message)s') handler.setFormatter(logging_format) app.logger.addHandler(handler) app.config.secret_key = "\xe8\xf7\xb9\xae\xfb\x87\xea4<5\xe7\x97D\xf4\x88)Q\xbd\xe1j'\x83\x13\xc7" app.config.from_object(ProductionConfig) #将配置类中的配置导入程序 app.permanent_session_lifetime = timedelta(hours=6) #session cookies 有效期 page_size = 60 app.config['UPLOAD_DIR'] = '/var/www/html/upload' app.config['PLUGIN_UPDATE_URL'] = 'https://ForrestX386.github.io/update' app.config['PLUGIN_DOWNLOAD_ADDRESS'] = 'https://ForrestX386.github.io/download' @app.route('/') def hello_world(): 　　return 'Hello World!' @app.errorhandler(404) def page_not_found(e): 　　template = ''' {%% block body %%} 
 
Oops! That page doesn't exist.
 
%s
 
 {%% endblock %%} ''' % (request.url) 　　return render_template_string(template), 404 if __name__ == '__main__': 　　app.run()
Config.py #!/usr/bin/env python # -*- coding: UTF-8 -*- class Config(object): ACCOUNT = 'vpgame' PASSWORD = 'win666666' class DevlopmentConfig(Config): 　　pass class TestingConfig(Config): 　　pass class ProductionConfig(Config): 　　HOST = '127.0.0.1' 　　PORT = 65521 　　DBUSERNAME = 'vpgame' 　　DBPASSWORD = 'win666666' 　　DBNAME = 'vpgame'

　　kali上搭建有漏洞的flask web服务

　　

　注：以上代码存在ssti漏洞点在于render_template_string函数在渲染模板的时候使用了%s来动态的替换字符串，我们知道Flask 中使用了Jinja2 作为模板渲染引擎，{ {}}在Ji