FakePip

Exploit sudoer with /usr/bin/pip install *

How to use

Simply download the setup.py file into remote target and execute this in local folder:

sudo /usr/bin/pip install . --upgrade --force-reinstall

Demonstration

Download the setup.py file into remote target

And execute the following command:

Then we get our shell back!

Author

This code is developed and maintained (if possible) by Andre Marques (@zc00l) Any misuse is not the author responsibility.