Hacking with environment variables
elttam.com
Hacking with environment variables
1–10 of 67 posts
Re: Hacking with environment variables
#2>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly.
> As for how the antigravity module opens your browser, it uses another module from the standard library called webbrowser. This module checks your PATH for a large variety of browsers, including mosaic, opera, skipstone, konqueror, chrome, chromium, firefox, links, elinks and lynx. It also accepts an environment variable BROWSER that lets you specify which process should be executed.
It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs. Every feature, every line of code potentially increases your attack surface, especially if it interacts with other features.
0. https://docs.microsoft.com/en-us/archive/blogs/larryosterman...
Re: Hacking with environment variables
#3>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library ca…
This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that level of control over a system, I don't think `antigravity` will make or break an RCE.
Re: Hacking with environment variables
#4>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library ca…
It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs.
...and yet there are plenty of horror stories about Win10 coming with lots of other "surprises" like Candy Crush installed by default, ads that fetch resources over the Internet, etc. I can almost hear a PM somewhere say "but they're not easter eggs, because they are documented somewhere." I'm sure people would be far less surprised and disgusted by a "real easter egg" that did something simple like developer's credits. Corporate bureaucracy at its worst...
Re: Hacking with environment variables
#5>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library ca…
So... don't import antigravity, an obvious joke module.
Re: Hacking with environment variables
#6See also the sudo bad environment variable list[1], which I recently found a 15 year old typo in.[2]
[1]: https://github.com/sudo-project/sudo/blob/master/plugins/sud... [2]: https://www.sudo.ws/repos/sudo/rev/bdf9c9e7f455
Re: Hacking with environment variables
#7>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library ca…
So... don't import antigravity, an obvious joke module.
Of course as a developer you (should) already have the power to run arbitrary code on your machine, so going through that route is silly. I think it's more in reference to locked-down environments like shared hosting, which want to run Python but restrict access to everything else. From that perspective, this ability looks like a sandbox escape.
Re: Hacking with environment variables
#8Earlier quoted context omitted.
So... don't import antigravity, an obvious joke module.
Of course as a developer you (should) already have the power to run arbitrary code on your machine, so going through that route is silly. I think it's more in reference to locked-down environments like shared hosting, which want to run Python but restrict access to everything else. From that perspective, this ability looks like a sandbox escape.
If the environment allows executing a browser, it allows executing a browser. Whether python is involved is irrelevant.
Re: Hacking with environment variables
#9>An unexpected exception to this is the antigravity module. The Python developers included an easter egg in 2008 which can be triggered by running import antigravity. This import will immediately open your browser to the xkcd comic that joked that import antigravity in Python would grant you the ability to fly. > As for how the antigravity module opens your browser, it uses another module from the standard library ca…
It was the possibility of security vulnerabilities that made software companies (more specifically Microsoft[0]) eschew easter eggs. ...and yet there are plenty of horror stories about Win10 coming with lots of other "surprises" like Candy Crush installed by default, ads that fetch resources over the Internet, etc. I can almost hear a PM somewhere say "but they're not easter eggs, because they are documented somewher…
[deleted]
Re: Hacking with environment variables
#10Warning, website wont load at all unless JavaScript is enabled.