45

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too crazy, just using the os library to browse the directory structure a little. I'm not sure how much damage I could do, though. There is a Python web app and a MySQL database running on the server.

Could I somehow give myself SSH access? I can't exactly figure out how I would go about that. I also don't think I can access the database, as I don't have any of the user information.

So, what is pretty well the practical limit of the worst damage I could do here?

Improve this question
4
  • However, the user information for the db will be stored in a file the apache user can read
    – Ángel
    Commented Jun 8, 2016 at 0:37
  • Can you share some light on HOW this exactly works? I mean how bad your code is?
    – M4ks
    Commented Jun 8, 2016 at 19:55
  • 8
    "run arbitrary Python code" =~ s/Python//
    – Nate Eldredge
    Commented Jun 8, 2016 at 21:41
  • What about sshuttle?
    – BonsaiOak
    Commented Jun 9, 2016 at 2:50

1 Answer 1

Reset to default
84

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user.

From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the app has access to the database already).

Also, as @Aroth pointed out in the comments, you can also compromise other apps running under the same user account.

Finally you can take a look at what version the running kernel/libraries are and eventually use an exploit to gain root privileges.

Improve this answer
9
  • 113
    In other words: take down that app NOW!
    – Philipp
    Commented Jun 7, 2016 at 18:16
  • 8
    Additionally you could presumably overwrite the webapp with one of your choosing, deploy additional webapps of your choosing, and take down or modify any other webapps running under the 'apache' user.
    – aroth
    Commented Jun 8, 2016 at 1:59
  • 17
    In other words: The worst damage is a almost fully hijacked system.
    – Zaibis
    Commented Jun 8, 2016 at 8:11
  • 4
    @hakermania the attacker is uploading his own SSH server binary, independent of the system's SSH server.
    – André Borie
    Commented Jun 8, 2016 at 9:04
  • 3
    @hackermania, the binary needn't act as a "traditional" SSH server. It can just sit and listen for TCP connections and, when it receives one, repeatedly subprocess.run() everything it gets sent.
    – ymbirtt
    Commented Jun 8, 2016 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .