Inject code into a running Python process
Injects code into a running Python process.
- gdb (https://www.gnu.org/s/gdb) (version 7.3+)
Download the latest stable release from PyPi: http://pypi.python.org/pypi/pyrasite
Grab the latest source by running:
git clone git://git.fedorahosted.org/git/pyrasite
You can also fork pyrasite on GitHub: http://github.com/lmacken/pyrasite
This pyrasite unit test injects a print(“Hello World!”) payload into a process and ensures it gets printed.
from pyrasite.inject import CodeInjector def test_injection(self): cmd = 'python -c "import time; time.sleep(0.5)"' p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE) ci = CodeInjector(p.pid, 'payloads/helloworld.py') ci.inject() stdout, stderr = p.communicate() assert 'Hello World!' in stdout, "Code injection failed"
Reverse Python Shell
This lets you easily introspect or alter any objects in your running process.
$ python >>> x = 'foo'
$ pyrasite <PID> payloads/reverse_python_shell.py $ nc -l localhost 9001 Python 2.7.1 (r271:86832, Apr 12 2011, 16:15:16) [GCC 4.6.0 20110331 (Red Hat 4.6.0-2)] Type 'quit' to exit. >>> print x foo >>> globals()['x'] = 'bar'
Viewing the largest objects in your process
This payload uses meliae to dump all of the objects in your process to an objects.json file (currently dumped in the working directory of your process).
$ pyrasite <PID> payloads/dump_memory.py
Pyrasite also provides a tool to view the values of largest objects in your process.
$ pyrasite-memory-viewer <PID> objects.json
$ pyrasite <PID> payloads/reverse_shell.py $ nc -l localhost 9001 Linux tomservo 126.96.36.199-0.fc15.x86_64 #1 SMP Tue Aug 16 04:10:59 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux Type 'quit' to exit. % ls
Pyrasite comes with a payload that generates an image of your processes call graph using pycallgraph.
$ pyrasite <PID> payloads/start_callgraph.py $ pyrasite <PID> payloads/stop_callgraph.py
Dumping modules, thread stacks, and forcing garbage collection
payloads/dump_modules.py payloads/dump_stacks.py payloads/force_garbage_collection.py
Additional installation notes
Mac OS X
If you don’t want to override Apple’s default gdb, install the latest version of gdb with a prefix (e.g. gnu)
$ ./configure --program-prefix=gnu $ pyrasite <PID> payloads/reverse_python_shell.py --prefix="gnu"
Since version 10.10, Ubuntu ships with a controversial patch that restricts the scope of ptrace, which can be disabled by running:
echo 0 > /proc/sys/kernel/yama/ptrace_scope