Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Removal
eval()
POC
$ pwn shellcraft amd64.crash --address '__import__("os").system("echo hi")' hi 5f5e5d5b5b5a59584831e4ffe4
safeeval
is used elsewhere in pwntools, so it may be helpful to replace the use ofeval()
here withsafeeval.expr()
.The above test case will (correctly) raise an error when
eval()
is replaced:Traceback (most recent call last): ... raise ValueError("opcode %s not allowed" % dis.opname[code]) ValueError: opcode LOAD_NAME not allowed
And will run as normal with a proper address:
$ pwn shellcraft amd64.crash --address '0x123' 5f5e5d5b5b5a59584831e4ffe4
Testing
I am struggling to find where to put doctests for this, if they are necessary.
Changelog
Making after PR.
P.S.: I made use of this bug for a local CTF I ran with a few others. You can see the challenge here while it's still up.