webPromedium

PageCraft — SSTI via Twig Template Engine in Post Content

hackadvisor

Task: PHP/Twig CMS blog platform where post content is rendered through unsandboxed Twig template engine. Solution: Injected {{[\"cat /root/flag.txt\"]|filter(\"system\")}} in post content, exploiting Twig's |filter() → PHP array_filter() → system() callback chain for RCE.

$ ls tags/ techniques/
rcephpssticmstemplate_injectiondecoy_flagtwighoneypot_flagfilter_callbackarray_filterblog
ssti_twig_rcetwig_filter_callback_systemphp_array_filter_rcetwig_unsandboxed_rendering
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups