2

I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor:

type('',(),{'a':5,'b':6,'c':7,'__int__':lambda x : exec("import os; os.system('whoami');"),'getB':lambda self : self.b})()

enter image description here

I have a situation at work where my input is passed as a string directly to the int() constructor but because I am injecting a string representing an anonymous class and not code representing an anonymous class directly, I am unable to achieve command execution using the above. I was wondering if anyone might know if either:

  1. Is there a string that I could pass to the int() constructor that would somehow be converted into an anonymous class (i.e. is there any kind of special string notation to represent an anonymous class)?
  2. If there is another approach where, given a string that is passed to an int() call, could an operating system command could be executed?

I guess even more generally than that, has anyone seen a way to execute any sort of command from a string passed to int()?

4
  • Welcome to the community. Do you have the source code? Nov 11, 2023 at 12:39
  • @SirMuffington source code of what?
    – schroeder
    Nov 11, 2023 at 13:10
  • Of the Python script Nov 12, 2023 at 11:51
  • I'm lost: what script?
    – schroeder
    Nov 13, 2023 at 8:56

1 Answer 1

2

Is there a string that I could pass to the int() constructor that would somehow be converted into an anonymous class (i.e. is there any kind of special string notation to represent an anonymous class)?

A string is simply a sequence of unicode characters (https://docs.python.org/3/howto/unicode.html). I don't see how this would ever be expected to behave as anything but a string -- or be expected to throw anything other than TypeError / become an integer when passed to int().

If there is another approach where, given a string that is passed to an int() call, could an operating system command could be executed?

Not unless your int() call is constructed something like int(eval(<input>)) which changes the question completely. Handling most-any data with eval() is not safe and should not be performed in this manner.

I guess even more generally than that, has anyone seen a way to execute any sort of command from a string passed to int()?

I have not. In your example, what you are passing to int() isn't a python string, it's python commands, thus why you are able to get it to execute and return whoami. From outside the program / from a string variable used in int(), I don't think anything of this sort should be possible.

Fundamentally I think you would encounter the same problem with the following command. Runs great if it's interpreted as Python commands (as follows)...

int(print(exec("import os; os.system('whoami');")))

... but if you are taking in a string, such as with int(input()), it would look as follows in your program and would not execute anything.

int('''print(exec("import os; os.system('whoami');"))''')

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .