Skip to content

Commit e611b65

Browse files
jamesmurphy-mcjamesmurphy-mc
committed
Add cmd vuln video
1 parent b6fe3c8 commit e611b65

3 files changed

Lines changed: 67 additions & 1 deletion

File tree

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ James and his team are available for consulting, contracting, code reviews, and
1212

1313
| N | Code | Video |
1414
|-----| --- |--- |
15-
| 137 | [src](videos/138_async_for_starlette) | [Async for loops in Python](https://youtu.be/dEZKySL3M9c) |
15+
| 139 | [src](videos/139_windows_cmd_vuln) | [New Windows Command Escape Vulnerability - Critical CVE ... or is it?](https://youtu.be/WNmNXc_EZdM) |
16+
| 138 | [src](videos/138_async_for_starlette) | [Async for loops in Python](https://youtu.be/dEZKySL3M9c) |
1617
| 137 | [src](videos/137_context_managers) | [The ins and outs of context managers and try-finally in Python](https://youtu.be/LBJlGwJ899Y) |
1718
| 136 | [src](videos/136_python_debugging) | [Python Debugging (PyCharm + VS Code)](https://youtu.be/COa-JHYuW3M) |
1819
| 135 | [src](videos/135_modern_logging) | [Modern Python logging](https://youtu.be/9L77QExPmI0) |

‎videos/139_windows_cmd_vuln/echo_args.bat‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
@echo off
2+
set index=1
3+
4+
:loop
5+
if "%~1"=="" goto :end
6+
echo arg%index%: %1
7+
set /a index+=1
8+
shift
9+
goto :loop
10+
11+
:end

‎videos/139_windows_cmd_vuln/main.py‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
import subprocess
2+
3+
4+
def teaser():
5+
untrusted_input = "&calc.exe"
6+
subprocess.run(["echo_args.bat", untrusted_input])
7+
8+
9+
def shell_ex():
10+
subprocess.run(
11+
["python.exe", "-c", "import sys; print(sys.argv)", "&", "echo", "LOL"],
12+
shell=False,
13+
)
14+
subprocess.run(
15+
["python.exe", "-c", "import sys; print(sys.argv)", "&", "echo", "LOL"],
16+
shell=True,
17+
)
18+
subprocess.run(
19+
["cmd.exe", "/c", "python.exe", "-c", "import sys; print(sys.argv)", "&", "echo", "LOL"],
20+
shell=False,
21+
)
22+
23+
24+
def obviously_bad():
25+
untrusted_input = "&calc.exe"
26+
subprocess.run(["python.exe", "-m", "timeit", untrusted_input], shell=True)
27+
28+
29+
def maybe_ok():
30+
untrusted_input = "&calc.exe"
31+
subprocess.run(["python.exe", "-m", "timeit", untrusted_input], shell=False)
32+
33+
34+
def the_cve():
35+
untrusted_input = "&calc.exe"
36+
subprocess.run(["echo_args.bat", untrusted_input], shell=False)
37+
38+
39+
def literally_noone():
40+
untrusted_input = "calc.exe"
41+
subprocess.run(["cmd.exe", "/c", untrusted_input], shell=False)
42+
43+
44+
def main():
45+
teaser()
46+
# shell_ex()
47+
# obviously_bad()
48+
# maybe_ok()
49+
# the_cve()
50+
# literally_noone()
51+
52+
53+
if __name__ == "__main__":
54+
main()

0 commit comments

Comments
 (0)