让用户提交Python代码并在服务器上执行,是一些 OJ、量化网站重要的服务,很多 CTF 也有类似的题。为了不让恶意用户执行任意的 Python 代码,就需要确保 Python 运行在沙箱中。沙箱经常会禁用一些敏感的函数,例如 os,研究怎么逃逸、防护这类沙箱还是蛮有意思的。 前言 Python 的沙箱逃逸的最终目标就是执行系统任意命令,次一点的写
all_modules_3 = ['AptUrl','hmac','requests_unixsocket','CommandNotFound','apport','hpmudext','resource','Crypto','apport_python_hook','html','rlcompleter','DistUpgrade','apt','http','runpy','HweSupportStatus','apt_inst','httplib2','scanext','LanguageSelector','apt_pkg','idna'...
'fcntl', 'ptyprocess', 'warnings', '_stat', 'filecmp', 'pwd', 'wave', '_string', 'fileinput', 'py_compile', 'weakref', '_strptime', 'fnmatch', 'pyatspi', 'webbrowser', '_struct', 'formatter', 'pyclbr', 'wsgiref', '_symtable', 'fractions', 'pydoc', 'xdg', '_sysconfig...
如果将 os 从 sys.modules 中剔除,os 就彻底没法用了: >>> sys.modules['os'] = 'not allowed' >>> import os >>> os.system('ls')Traceback (most recent call last): File "<stdin>", line 1, in <module> AttributeError: 'str' object has no attribute 'system' >>> 1. 注意,这里不...
class LockableFile(file): def lock (self, operation, length=0, start=0, whence=0): import fcntl return fcntl.lockf(self.fileno(), operation, length, start, whence) The now-obsolete posixfile module contained a class that emulated all of a file object's methods and also added a lock(...
sizeof_hd_driveid = struct.calcsize(hd_driveid_format_str) # ensure our format string is the correct size # 512 is extracted using sizeof(struct hd_id) in the c code assert sizeof_hd_driveid == 512 # Call native function buf = fcntl.ioctl(fd, HDIO_GET_IDENTITY, " " * sizeof...
'fcntl', 'pprint', 'types', '_md5', 'filecmp', 'profile', 'unicodedata', '_multibytecodec', 'fileinput', 'pstats', 'unittest', '_multiprocessing', 'fnmatch', 'pty', 'urllib', '_osx_support', 'formatter', 'pwd', 'urllib2', '_pyio', 'fpformat', 'py_compile', 'urlparse'...
These modules work alongside the built-inopen()function to provide comprehensive file management capabilities. File handling modules: io: Core tools for working with various types of I/O pathlib: Object oriented filesystem paths fileinput: Iterate over lines from multiple input streams ...
36.5. crypt — Function to check Unix passwords 36.6. dl — Call C functions in shared objects 36.7. termios — POSIX style tty control 36.8. tty — Terminal control functions 36.9. pty — Pseudo-terminal utilities 36.10. fcntl — The fcntl and ioctl system calls ...
fcntl.pyi filecmp.pyi fileinput.pyi fnmatch.pyi formatter.pyi fractions.pyi ftplib.pyi functools.pyi gc.pyi genericpath.pyi getopt.pyi getpass.pyi gettext.pyi glob.pyi graphlib.pyi grp.pyi gzip.pyi hashlib.pyi heapq.pyi hmac.pyi imaplib.pyi imghdr.pyi imp.pyi inspect.pyi io.pyi ipaddre...