Jinyu Liu passos

如何使用python3逃逸沙箱，获得进程上下文权限提升

最近突发奇想，想对所掌握的python知识进行总结一下，目前其实还停留在python层面如何使用，还没有深入到虚拟机部分，如果下面有哪些错误，欢迎指出。

OJ(Online judge, 在线编程测评提交代码到后台运行检查)网站一般都允许各种各样的代码提交，其中很有可能包含python3，于是决定尝试通过python3的代码执行，进行沙箱逃逸，以及绕过各种限制。

我随便找了一个OJ网站，这个站点的python3有如下限制

	Add the following in .zshrc:

	...
	plugins=(osx git zsh-autosuggestions zsh-syntax-highlighting zsh-nvm docker kubectl)
	...

	### Fix slowness of pastes with zsh-syntax-highlighting.zsh
	pasteinit() {
	OLD_SELF_INSERT=${${(s.:.)widgets[self-insert]}[2,3]}
	zle -N self-insert url-quote-magic # I wonder if you'd need `.url-quote-magic`?

	package com.sam016.vsflatomation.service.ble;

	import java.util.HashMap;
	import java.util.UUID;

	public class AllGattCharacteristics {
	private static HashMap<String, String> attributes = new HashMap();

	static {
	attributes.put("00002a00-0000-1000-8000-00805f9b34fb", "Device Name");

	#!/usr/bin/env python3

	"""
	Binary Indexed Tree / Fenwick Tree

	https://www.hackerearth.com/practice/notes/binary-indexed-tree-made-easy-2/
	https://www.topcoder.com/community/data-science/data-science-tutorials/binary-indexed-trees/
	https://www.youtube.com/watch?v=v_wj_mOAlig
	https://www.youtube.com/watch?v=kPaJfAUwViY
	"""

	# Update Jan 2024
	# Deploying Cloud Functions is much simpler than it was 6 years ago.
	# I'm leaving the gist in it's original 2018 state for now,
	# but skip the the recent comments below for a simpler solution.

	variables:
	GCP_ZONE: us-central1-a

	stages:
	- npm-install

	function mapValues(obj, fn) {
	return Object.keys(obj).reduce((result, key) => {
	result[key] = fn(obj[key], key);
	return result;
	}, {});
	}

	function pick(obj, fn) {
	return Object.keys(obj).reduce((result, key) => {
	if (fn(obj[key])) {