Exploring Python SSTI Payloads - Bolt Beyond Root [HackTheBox]
I'll use Bolt from HackTheBox as an excuse to dive into three different common Python SSTI payloads.
Full Bolt Writeup: https://0xdf.gitlab.io/2022/02/19/htb...
[00:00] Introduction
[00:46] PayloadsAllTheThings page
[01:19] First payload in Python REPL
[07:15] List subclasses on Bolt
[08:15] Getting offset to subprocess.popen
[09:30] Second payload
[13:10] Third payload on Bolt
[14:08] Starting into Jinja2 source
[15:14] Using an example class
[18:05] Back into Jinja2 source
[19:45] POC with Jinja2 utils.py in local terminal
[21:45] Summary