Privilege Escalation via Python Library Hijacking (Conceptual Overview)
Python library hijacking occurs when privileged Python scripts import modules from directories writable by unprivileged users.
🐍 What is Python Library Hijacking?
Python searches for modules in sys.path. If a writable directory appears early in the path, attackers can place malicious modules there.
🧠 How Library Hijacking Happens (High-Level)
- ✔ Root-owned Python script imports a module
- ✔ Module search path includes writable directory
- ✔ Attacker creates malicious module
- ✔ Script executes malicious code as root
🔥 Why Library Hijacking Is Dangerous
- ✔ Bypasses file permissions
- ✔ Difficult to detect
- ✔ Common in custom scripts
🌍 Real-World Example (Defensive View)
A backup script runs as root and imports a custom module from a directory writable by developers. A developer replaces the module.
🔍 Detecting Library Hijacking Risks
- ✔ Check Python scripts for relative imports
- ✔ Review sys.path for writable directories
- ✔ Monitor module modifications
🛡️ Preventing Library Hijacking
- ✔ Use absolute imports
- ✔ Set secure PYTHONPATH
- ✔ Install modules system-wide
- ✔ Use virtual environments
🧾 Key Takeaways
- ✔ Python path must be secure
- ✔ Audit privileged scripts
- ✔ Monitor module integrity
🐍 Python – Command Awareness
Common commands observed during audits when checking Python paths. Shown for defensive awareness only.
🔍 Python Path Discovery
-
View Python sys.path
Why used: Identify module search path.python3 -c "import sys; print(sys.path)"
🛡️ Defender Takeaways
- ✔ Audit Python paths
- ✔ Remove writable directories
- ✔ Use secure import practices
