In this blog post, I’ll show you how recreated a Python library hijacking vulnerability on my home network.

The Wonderland box on TryHackMe was the inspiration for exploring this kind of vulnerability.

In my previous Wonderland walkthrough blog post, I highlighted an example of exploiting the ‘random’ module to switch users without knowing their password.

In this post, I’ll guide you through the setup and execution of the exploit. You can also watch the accompanying video tutorial here:

What is Python Library Hijacking?

When a user has permission to run a file as another user it is possible to create a spoof file that Python will load instead of the originally intended module or library. The necessary conditions for Python library hijacking are:

1. The user must have sudo permissions to run a Python file .py as another user
2. The Python path must be set to look first in the folder where the spoof file is stored 

Setup

In order to re-create this vulnerability, I had to learn how to set up the above conditions for the exploit.

On my home network, I have a Raspberry Pi 3b running DietPi operating system. Originally I set this up to run Pi-hole to filter ads out from my home network.

In order to set up the permissions to run a file as another user I edited the sudoers file with visudo.

Visudo is a special editor specifically for editing the sudoers file. It only allows one user to edit the file at a time, and also checks user edits for correct syntax. I created a file called ‘checkmypermissions.py’ and granted sudo permissions to vulnerableuser to run it as user ben. 

To do this I used the command ‘sudo visudo’ to edit sudoers file, and then I added the second line for vulnerable user:

# User privilege specification

root ALL=(ALL:ALL) ALL

vulnerableuser ALL=(ben:1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py

The nice thing about visudo is that it checks your formatting to make sure that there are not any errors, and it will even suggest changes to help you format the permissions correctly.

This functionality helped me save time getting the correct spacing and punctuation on the new sudoers line.

Running the Exploit

Once the permissions were set up I ssh’d into vulnerableuser@<raspberry pi IP>. Running the ‘sudo -l’ command showed me the granular sudo permissions.

The line above (ben : 1001) /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py shows that as vulnerableuser I can execute the checkmypermissions.py file as the user Ben.  

All that is left to do is to check the Python PATH to make sure that it checks first in the current directory, and then create a python file named numpy.py with code to spawn a shell. One way to check the Python PATH is:

Python

import sys

sys.path

In the example below, we can see that the python PATH is already set to search in the current working directory (''). 

Next we create the numpy.py file to spawn a shell.

nano numpy.py

import os

os.system("/bin/bash")

It is important to first set up execute permissions on the spoofed numpy.py file:

chmod +x numpy.py

Now we can carry out the python library hijack and spawn a shell as user ben without knowing their password by running the following command:

sudo -u ben /usr/bin/python3 /home/vulnerableuser/checkmypermissions.py  

Project Learnings

Learning #1

I learned that Visudo is a special editor within Linux to change the sudoers file /etc/sudoers.

It helps check formatting to avoid any errors or crashes from poorly written lines. The sudoers file allows the root user to granularize user permissions with the sudoers file on Linux.

Learning #2

Granting run as another user file permissions can expose a machine to library hijacking vulnerabilities.

Running sudo -l can help expose special user file permissions when enumerating for attack vectors to execute privilege escalation.

Learning #3

I found that it is helpful to compile a custom shortlist of Python and bash commands new to me for each project. I borrowed this strategy from my experience with language learning.

Over the years, I’ve improved my Mandarin by taking notes on new vocabulary words and grammar patterns. When working on a new topic area I would always create my own custom grammar and vocabulary lists for reference.

I’ve found that the simple act of focusing on recording a list helps to cement my learning and creates a nice reference for later use.

Quick Fix: Python raises the ModuleNotFoundError: No module named 'dotenv' when it cannot find the library dotenv. The most frequent source of this error is that you haven’t installed dotenv explicitly with pip install python-dotenv. Alternatively, you may have different Python versions on your computer, and dotenv is not installed for the particular version you’re using.

Other variants of the installation statement you should try if this doesn’t work are (in that order):

python -m pip install python-dotenv
python3 -m pip install python-dotenv
pip install python-dotenv
pip3 install python-dotenv
sudo pip3 install python-dotenv
pip install python-dotenv – user
py -m pip install python-dotenv

Also, you can try those on Anaconda and Jupyter Notebooks:

# Anaconda
conda install -c conda-forge python-dotenv # Jupyter Notebook
!pip install python-dotenv

Problem Formulation

You’ve just learned about the awesome capabilities of the dotenv library and you want to try it out, so you start your code with the following statement:

import dotenv

or from the official “Getting Started”:

from dotenv import load_dotenv load_dotenv() # take environment variables from .env.

This is supposed to import the dotenv library into your (virtual) environment. However, it only throws the following ImportError: No module named dotenv:

>>> import dotenv

Traceback (most recent call last): File "<pyshell#6>", line 1, in <module> import dotenv

ModuleNotFoundError: No module named 'dotenv'

Solution Idea 1: Install Library dotenv

The most likely reason is that Python doesn’t provide dotenv in its standard library. You need to install it first!

Before being able to import the dotenv module, you need to install it using Python’s package manager pip. Make sure pip is installed on your machine.

To fix this error, you can run the following command in your Windows shell:

$ pip install python-dotenv

This simple command installs dotenv in your virtual environment on Windows, Linux, and MacOS. It assumes that your pip version is updated. If it isn’t, use the following two commands in your terminal, command line, or shell (there’s no harm in doing it anyways):

$ python -m pip install – upgrade pip

$ pip install python-dotenv

Note: Don’t copy and paste the $ symbol. This is just to illustrate that you run it in your shell/terminal/command line.

Solution Idea 2: Fix the Path

The error might persist even after you have installed the dotenv library. This likely happens because pip is installed but doesn’t reside in the path you can use. Although pip may be installed on your system the script is unable to locate it. Therefore, it is unable to install the library using pip in the correct path.

To fix the problem with the path in Windows follow the steps given next.

Step 1: Open the folder where you installed Python by opening the command prompt and typing where python

Step 2: Once you have opened the Python folder, browse and open the Scripts folder and copy its location. Also verify that the folder contains the pip file.

Step 3: Now open the Scripts directory in the command prompt using the cd command and the location that you copied previously.

Step 4: Now install the library using pip install python-dotenv command. Here’s an analogous example:

After having followed the above steps, execute our script once again. And you should get the desired output.

Other Solution Ideas

• The ModuleNotFoundError may appear due to relative imports. You can learn everything about relative imports and how to create your own module in this article.
• You may have mixed up Python and pip versions on your machine. In this case, to install dotenv for Python 3, you may want to try python3 -m pip install python-dotenv or even pip3 install python-dotenv instead of pip install python-dotenv
• If you face this issue server-side, you may want to try the command pip install – user python-dotenv
• If you’re using Ubuntu, you may want to try this command: sudo apt install python-dotenv
• You can also check out this article to learn more about possible problems that may lead to an error when importing a library.

Understanding the “import” Statement

import dotenv

In Python, the import statement serves two main purposes:

• Search the module by its name, load it, and initialize it.
• Define a name in the local namespace within the scope of the import statement. This local name is then used to reference the accessed module throughout the code.

What’s the Difference Between ImportError and ModuleNotFoundError?

What’s the difference between ImportError and ModuleNotFoundError?

Python defines an error hierarchy, so some error classes inherit from other error classes. In our case, the ModuleNotFoundError is a subclass of the ImportError class.

You can see this in this screenshot from the docs:

You can also check this relationship using the issubclass() built-in function:

>>> issubclass(ModuleNotFoundError, ImportError)

True

Specifically, Python raises the ModuleNotFoundError if the module (e.g., dotenv) cannot be found. If it can be found, there may be a problem loading the module or some specific files within the module. In those cases, Python would raise an ImportError.

If an import statement cannot import a module, it raises an ImportError. This may occur because of a faulty installation or an invalid path. In Python 3.6 or newer, this will usually raise a ModuleNotFoundError.

Related Videos

The following video shows you how to resolve the ImportError:

The following video shows you how to import a function from another folder—doing it the wrong way often results in the ModuleNotFoundError:

How to Fix “ModuleNotFoundError: No module named ‘dotenv’” in PyCharm

If you create a new Python project in PyCharm and try to import the dotenv library, it’ll raise the following error message:

Traceback (most recent call last): File "C:/Users/.../main.py", line 1, in <module> import dotenv

ModuleNotFoundError: No module named 'dotenv' Process finished with exit code 1

The reason is that each PyCharm project, per default, creates a virtual environment in which you can install custom Python modules. But the virtual environment is initially empty—even if you’ve already installed dotenv on your computer!

Here’s a screenshot exemplifying this for the pandas library. It’ll look similar for dotenv.

The fix is simple: Use the PyCharm installation tooltips to install Pandas in your virtual environment—two clicks and you’re good to go!

First, right-click on the pandas text in your editor:

Second, click “Show Context Actions” in your context menu. In the new menu that arises, click “Install Pandas” and wait for PyCharm to finish the installation.

The code will run after your installation completes successfully.

As an alternative, you can also open the Terminal tool at the bottom and type:

$ pip install python-dotenv

If this doesn’t work, you may want to set the Python interpreter to another version using the following tutorial: https://www.jetbrains.com/help/pycharm/2016.1/configuring-python-interpreter-for-a-project.html

You can also manually install a new library such as dotenv in PyCharm using the following procedure:

• Open File > Settings > Project from the PyCharm menu.
• Select your current project.
• Click the Python Interpreter tab within your project tab.
• Click the small + symbol to add a new library to the project.
• Now type in the library to be installed, in your example Pandas, and click Install Package.
• Wait for the installation to terminate and close all popup windows.

Here’s an analogous example:

Here’s a full guide on how to install a library on PyCharm.

• How to Install a Library on PyCharm