Manipulation of PYTHONPATH Environment Variable

OS Windows, Linux, macOS Category Build Hook Abuse Persistence Persistent Build setup. py Distributions sdist As previously described, Python looks up the sys. path variable in order to determine which directories to use for importing modules. The value of the sys. path is generated through site module of Python.

It collects user and site folders, and combines them together with “. pth” files and the value of the PYTHONPATH environment variable. If the adversary is able to control the value of PYTHONPATH environment variable, they can point it to anywhere they would like and manipulate imported packages. Every Python invocation of corresponding users would be infected, achieving a user level persistence on the targeted Python environment. This technique is suitable only through source distributions that are leverage “setup.

py” based builds. Although its abuse is well-known by the community, vulnerabilities arising from the misuse of the PYTHONPATH variable were also previously reported. If used in conjunction with Python site hooks, the malicious payload within “sitecustomize. py” can be invoked without requiring it to be placed under the packages directory. We can extend module search towards the malicious package folder to achieve code execution.

In Figure 5, the “setup. py” file leverages distutils command classes and alters the user profile to manipulate the value of PYTHONPATH. Figure 5. “setup. py” manipulating PYTHONPATH environment variable.

Once the user profile is altered, future Python invocations from new shell sessions will lead to infected executions. User profile updates will impact the current shell session, since its preferences are already imported ahead of its creation.