Jinja2 SSTI - Filter Bypass help needed

@AlexisH, thanks for the hints! they helped a lot
@TazWake, check what AlexisH mentioned regarding the update function, I didn’t find it easily in the flask documentation, but it’s there. If you need another boost in the challenge, let me know

@cerebro11 said:

@AlexisH, thanks for the hints! they helped a lot
@TazWake, check what AlexisH mentioned regarding the update function, I didn’t find it easily in the flask documentation, but it’s there. If you need another boost in the challenge, let me know

Thanks - I kind of gave up on it a few months ago because I couldn’t make it work. I might try to get back into it next week though.

@cerebro11
I try to do the same lab and till now I also miserably fail. In case you can provide me some more help this would be great.

I can update update the content of the config by executing config.update({}), i’m also able to show the content of the request etc. The problem is that the required payload
{{config.class.init.globals[‘os’].popen(‘ls’).read()}} is way to long and when I use it from an other field it is always a string object and nothing else.

Type your comment> @AlexisH said:

The problem with strings is they will always be strings - so you will never be able to call them as objects. This really gets into the way template engines actually work when rendering output. Let me know if you want a nudge…

Just wanted to pop in and say “Thank You!” for your last two comments… config variables being used for both strings and objects made things click for me.

@6d74 & @AlexisH I defenitifly need a nudge.

It is not a problem update the content of the config dict to a object. The problem is that as soon i try to access something subclassess() the string is to long.

I tried it with “{{config.update({1:‘’.class.base.subclasses()[132]})}}”@v.vv
or also by splitting the config update to several and reused it in the other ones.