46

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too crazy, just using the os library to browse the directory structure a little. I'm not sure how much damage I could do, though. There is a Python web app and a MySQL database running on the server.

Could I somehow give myself SSH access? I can't exactly figure out how I would go about that. I also don't think I can access the database, as I don't have any of the user information.

So, what is pretty well the practical limit of the worst damage I could do here?

  • However, the user information for the db will be stored in a file the apache user can read – Ángel Jun 8 '16 at 0:37
  • Can you share some light on HOW this exactly works? I mean how bad your code is? – M4ks Jun 8 '16 at 19:55
  • 6
    "run arbitrary Python code" =~ s/Python// – Nate Eldredge Jun 8 '16 at 21:41
  • What about sshuttle? – BonsaiOak Jun 9 '16 at 2:50
90

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user.

From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the app has access to the database already).

Also, as @Aroth pointed out in the comments, you can also compromise other apps running under the same user account.

Finally you can take a look at what version the running kernel/libraries are and eventually use an exploit to gain root privileges.

  • 112
    In other words: take down that app NOW! – Philipp Jun 7 '16 at 18:16
  • 8
    Additionally you could presumably overwrite the webapp with one of your choosing, deploy additional webapps of your choosing, and take down or modify any other webapps running under the 'apache' user. – aroth Jun 8 '16 at 1:59
  • 15
    In other words: The worst damage is a almost fully hijacked system. – Zaibis Jun 8 '16 at 8:11
  • 4
    @hakermania the attacker is uploading his own SSH server binary, independent of the system's SSH server. – André Borie Jun 8 '16 at 9:04
  • 3
    @hackermania, the binary needn't act as a "traditional" SSH server. It can just sit and listen for TCP connections and, when it receives one, repeatedly subprocess.run() everything it gets sent. – ymbirtt Jun 8 '16 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.