Portswigger -Server-side template injection with a custom exploit

In this lab i was able to gain knowledge in bypassing server side template injection(SSTI) using custom payload and methodolagy.

LAB This lab is vulnerable to server-side template injection. To solve the lab, create a custom exploit to delete the file /.ssh/id_rsa from Carlos's home directory.

You can log in to your own account using the following credentials: wiener:peter

Solution

As the first step i tried to crawl through the web page and i was able to find that there was a file upload functionality.

I have uploaded a normal file and another php file.

After uploading the php file i got sort of an odd error.

As it can be seen there are two specific massages from this error log.

user->setAvatar()

This function is used to set the profile picture we will be needing this function later.

home/Carlos/User.php

we can see the directory and the function of the User.php which contain mandatory functions for the User profile(Update,Delete).

After testing the upload function i went on with the other functions.

Preferred Name function

This function Leads to an SSTI vulnerability.From this we can check for the User.php functions.

As shown in the above we can set the profile picture to arbitary file from the system.

user.setAvatar('/home/carlos/User.php','image/jpg')

by setting this value for the user.setAvatar parameter we can read the php functions available for the user.

We can see there are three seperate functions in this User.php file.

So now we just have to invoke the gdprDelete() function to delete the file /.ssh/id_rsa from Carlos's home directory.

But for that we have to set the Avatar for that file and then we can delete the file in there.

First we set the Avatar as the file we need to be removed.

after refreshing the comment section page we can get the Avatar link by copying the avatar image link.

After that again in the repeater we can change the user.gdprDelete() function just calling that function we can delete it.

after refreshing the comment section page we can finally delete the .ssh file.