Overview

This directory houses sinks for code execution in Python. This includes the execution of both Python code and shell commands (both on the local machine, and remotely via protocols like SSH).

Future Work

Below is a list of libraries with known code execution sinks, for which we still need to write exploit demos.

SSH Libraries

Stub exploits for these libraries can be found in ssh_command_execution.py

• paramiko
• pexpect
• fabric
• spur
• asyncssh
• ssh2-python
• twisted.conch
• trigger
• parallel-ssh
• scrapli
• redexpect
• netmiko

Templating Libraries

Stub exploits for these libraries can be found in server_side_template_code_execution.py

• Tornado
• Mako
• Chameleon
• Cheetah
• Genshi
• Trender
• Chevron
• Airspeed