0

I have next code:

    if request.method == 'POST':
        exp = request.form['Expression']
        for i in exp:
            if i in ascii_letters:
                return render_template('index.html', exp='', result="Only [0-9] and special characters")
        try:
            result = eval(exp)
        except Exception as e:
            result = 'Something went wrong'

        return render_template('index.html', exp=exp, result=result)

    else:
        return render_template('index.html', exp='', result='')

What can I do to execute a shell command?

I tried, something like this:

"\145\170\145\143(__\151\155\160\157\162\164__('\157\163').\163\171\163\164\145\155('\154\163'))"

result:

exec(__import__('os').system('ls'))

If I change the input data to something like this

\145\170\145\143("__\151\155\160\157\162\164__('\157\163').\163\171\163\164\145\155('\154\163')")

result:

Something went wrong
5
  • Welcome to the community. By next you mean next.js? Or the following code? Commented Feb 26 at 15:29
  • @SirMuffington, following code. My English is bad and it`s machine translate. I'm sorry if there are any mistakes.
    – oracle
    Commented Feb 26 at 17:21
  • In your exception block, add: print(e). Then you wiĺl have the full stack trace with details about the exception. Why guess when the information is available?
    – Kate
    Commented Apr 15 at 14:47
  • The problem is that you are trying to avoid the ascii check by escaping the characters, but then eval will receive the escaped values and not interpret them correctly. You need at least a prefix that is valid code and does not require dealing with character escapes... that seems hard without using any letter, maybe impossible even. Usually you defeat these checks by accessing some chain of attributes which lead you to reaching some dangerous object, but here with no letters at all I don't know what you could do.
    – Bakuriu
    Commented Apr 15 at 19:19
  • Tried to iterate over all built-ins, and there isn't a single one which has an attribute without ascii letters in its name. So the only hope would be something using non-ascii letters... but AFAIK Python built-ins/stdlib restrict themselves to ASCII so unless this code has access in its scope to something peculiar whose name contains only non-ascii letters & symbols/numbers then I'd say this could be secure..
    – Bakuriu
    Commented Apr 15 at 19:28

0

You must log in to answer this question.

Browse other questions tagged .