5

I was doing a kind of hacking challenge, a part of which found me stuck inside a restricted shell which had very few commands. One of the available commands was echo. After a few hours of banging my head off the wall, I decided to peak at some hints. It turns out that echo os.system('/bin/bash') would break you right out of the restricted shell... it's only after I saw this that I was able to google it, but I haven't found any info on it other than that you can do it in some restricted shell situations. It doesn't work on my terminal when I tried it with zsh and bash... why does this even work? The os.system part looks like Python to me.. Can someone provide me with some background on it? If this is Python, how else can it be used with echo?

  • 1
    It does look like python, and python's input() function calls eval() on the result. I suspect that's what the vulnerability is. That's why raw_input() is typically recommended in python2. – jordanm Jun 13 '17 at 0:17
  • 3
    sounds like an old vulnerability in LShell (restricted shell implemented in python). Also mentioned here: aldeid.com/wiki/Lshell – user234931 Jun 13 '17 at 0:24
4

This seems to have been an issue that existed in LShell 0.9.15, a restricted shell implemented in python.

The vulnerable function was called check_path(), which was used to check if a user was allowed to access the given path on the command line.

The problem was that this function used eval() as a mean to strip quotes from the command line, and this would happily execute any valid python expression as well.

        for item in line:
            # remove potential quotes
            try:
                item = eval(item)
            except:
                pass

This issue was later fixed in the following commit by replacing the eval() call with a regex substitution: https://github.com/ghantoos/lshell/commit/4e05ac2e9c12142beed0e0fa16331ee0fd7dbd42#diff-edb4dda47bc5b086988a93df2615df6f

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.