Python

Dangerous Functions

commands.getoutput, commands.getstatus, commands.getstatusouput, compile, cPickle.load
cPickle.loads, eval, exec, execfile, input, marshal.load, marshal.loads, os.execl, 
os.execle, os.execlp, os.execlpe, os.execv, os.execve, os.execvp, os.execvpe, os.popen
os.popen2, os.popen3, os.popen4, os.spawnl, os.spawnle, os.spawnlp, os.spawnlpe
os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe, os.startfile, os.system, pickle.load
pickle.loads, popen2.popen2, popen2.popen3, popen2.popen4, shelve.open, subprocess.call
subprocess.check_call, subprocess.check_output, subprocess.Popen, yaml.load

Break out, input() example

$ cat siteisup_test.py
import requests

url = input("Enter URL here:")
page = requests.get(url)
if page.status_code == 200:
	print "Website is up"
else:
	print "Website is down"

PyInstaller / PyInstxtractor

“PyInstaller reads a Python script written by you. It analyzes your code to discover every other module and library your script needs in order to execute. Then it collects copies of all those files – including the active Python interpreter! – and puts them with your script in a single folder, or optionally in a single executable file.”

Single executable files created with PyInstaller can be extracted using pyinstxtractor. Make sure to have run the script with correct python version!

Decompile:

Last updated

Was this helpful?