0×01. 测验代码
为了更好地演示Flask/Jinja2 开发中的SSTI问题，咱们建立一个小的POC程序，主要由两个python脚本组成， 其间page_not_found 存在SSTI缝隙：
Flask-test.py
    #!/usr/bin/env python
    # -*- coding:utf8 -*-
   
   
    import hashlib
    import logging
    from datetime import timedelta
   
    from flask import Flask
    from flask import request
    from flask import config
    from flask import session
    from flask import render_template_string
   
   
    from Config import ProductionConfig
   
    app = Flask(__name__)
    handler = logging.StreamHandler()
    logging_format = logging.Formatter(
                '%(asctime)s - %(levelname)s - %(filename)s - %(funcName)s - %(lineno)s - %(message)s')
    handler.setFormatter(logging_format)
    app.logger.addHandler(handler)
   
    app.config.secret_key = "xe8xf7xb9xaexfbx87xea4
    app.config.from_object(ProductionConfig) #将装备类中的装备导入程序
    app.permanent_session_lifetime = timedelta(hours=6) #session cookies 有效期
    page_size = 60
    app.config['UPLOAD_DIR'] = '/var/www/html/upload'
    app.config['PLUGIN_UPDATE_URL'] = 'https://ForrestX386.github.io/update'
    app.config['PLUGIN_DOWNLOAD_ADDRESS'] = 'https://ForrestX386.github.io/download'
   
   
   
    @app.route('/')
    def hello_world():
        return 'Hello World!'
   
    @app.errorhandler(404)
    def page_not_found(e):
        template = '''
    {%% block body %%}
       
            Oops! That page doesn't exist.
            %s
       
    {%% endblock %%}
    ''' % (request.url)
        return render_template_string(template, dir=dir,help=help, locals=locals), 404
   
    if __name__ == '__main__':
        app.run(host='0.0.0.0')
 Config.py
    #!/usr/bin/env python
    # -*- coding: UTF-8 -*-
   
   
    class Config(object):
        ACCOUNT = 'vpgame'
        PASSWORD = 'win666666'
   
   
    class DevlopmentConfig(Config):
        pass
   
   
    class TestingConfig(Config):
        pass
   
   
    class ProductionConfig(Config):
        HOST = '127.0.0.1'
        PORT = 65521
        DBUSERNAME = 'vpgame'
        DBPASSWORD = 'win666666'
        DBNAME = 'vpgame'
履行 python Flask-test.py

0×02. Flask/Jinja2 开发中的SSTI 利用之恣意文件读取
先介绍一些概念
关于类目标
instance.__class__ 能够获取当时实例的类目标

咱们知道python中新式类（也便是显现承继object目标的类）都有一个特点__class__能够获取到当时实例对应的类，随意挑选一个简略的新
式类实例，比方”,一个空字符串，便是一个新式类实例，所以”.__class__ 就能够获取到实例对应的类（也便是）
类目标中的特点__mro__
class.__mro__ 获取当时类目标的一切承继类

[1] [2] [3]  黑客接单网