不郑 notzheng

如何使用python3逃逸沙箱，获得进程上下文权限提升

最近突发奇想，想对所掌握的python知识进行总结一下，目前其实还停留在python层面如何使用，还没有深入到虚拟机部分，如果下面有哪些错误，欢迎指出。

背景

OJ(Online judge, 在线编程测评提交代码到后台运行检查)网站一般都允许各种各样的代码提交，其中很有可能包含python3，于是决定尝试通过python3的代码执行，进行沙箱逃逸，以及绕过各种限制。

我随便找了一个OJ网站，这个站点的python3有如下限制

云

IaaS指提供系统（可以自己选）或者储存空间之类的硬件，软件要自己手动装。PaaS提供语言环境和框架（可以自己选）。SaaS只能使用开发好的软件（卖软件本身，如税务会计、表格文字处理）。BaaS一般类似于非关系数据库，但各家不通用
云服务的特点：零前期成本 & 按需付费 & 弹性（类似于租，可随时多加、退掉；但没有残值）、高可用（放在机房中，不同AZ间水电隔离）

其他人的集合

https://education.github.com/pack GitHub学生包，需用教育邮箱验证。各种福利，可从DigitalOcean上手
https://github.com/ripienaar/free-for-dev 本文尽量不与此项目重复
https://free.zhelper.net/

Use Proxy for Git/GitHub

Generally, the Git proxy configuration depends on the Git Server Protocol you use. And there're two common protocols: SSH and HTTP/HTTPS. Both require a proxy setup already. In the following, I assume a SOCKS5 proxy set up on localhost:1080. But it can also be a HTTP proxy. I'll talk about how to set up a SOCKS5 proxy later.

SSH Protocol

When you do git clone ssh://[user@]server/project.git or git clone [user@]server:project.git, you're using the SSH protocol. You need to configurate your SSH client to use a proxy. Add the following to your SSH config file, say ~/.ssh/config:

ProxyCommand nc -x localhost:1080 %h %p

	import * as React from 'react'
	import { SpringValue, easings, useSpring } from 'react-spring'

	/**
	* Hook that animates height when args.animationKey changes
	*
	* Ex:
	* const animatedBlock = useAnimatedHeight({
	* animationKey: key,
	* })

	#! Aaaaaaaaaaa this is JS!!!
	// https://github.com/tc39/proposal-hashbang
	// This file is mixing all new syntaxes in the proposal in one file without considering syntax conflict or correct runtime semantics
	// Enjoy!!!
	// Created at Nov 23, 2018

	for await(const x of (new A // https://github.com/tc39/proposal-pipeline-operator
	\|> do { // https://github.com/tc39/proposal-do-expressions
	case(?) { // https://github.com/tc39/proposal-pattern-matching
	when {val}: class {

	#!/usr/bin/env zsh

	set -e;
	set +m; # Job control would've been nice, but manual round robin it is, sigh.

	if [ -z "${ZSH_VERSION+x}" ]; then
	echo 'Try again with zsh.';
	exit 1;
	fi;

	FROM node:10-alpine as build

	WORKDIR /usr/src/app

	COPY package.json .
	COPY yarn.lock .
	COPY packages/shared ./packages/shared
	COPY packages/api ./packages/api

	RUN yarn install --pure-lockfile --non-interactive

	var SecTrustEvaluate_handle =
	Module.findExportByName('Security', 'SecTrustEvaluate');
	var SecTrustEvaluateWithError_handle =
	Module.findExportByName('Security', 'SecTrustEvaluateWithError');
	var SSL_CTX_set_custom_verify_handle =
	Module.findExportByName('libboringssl.dylib', 'SSL_CTX_set_custom_verify');
	var SSL_get_psk_identity_handle =
	Module.findExportByName('libboringssl.dylib', 'SSL_get_psk_identity');
	var boringssl_context_set_verify_mode_handle = Module.findExportByName(
	'libboringssl.dylib', 'boringssl_context_set_verify_mode');

	const path = require('path')
	const fs = require('fs')
	const { execSync } = require('child_process')

	let file = path.join(process.cwd(), 'core.wxvpkg')
	if (fs.existsSync(file)) {
	execSync(`rmtrash ${file}`)
	}

	let fd = fs.openSync(file, 'w')