skip to content
~/bokkapig
_
hack the box machine writeups
[1]
machines
[2]
refs
[3]
cheatsheet
[4]
search
[5]
pdf-inject
← cd ../tags
grep -l "Python Pyc Injection" ./machines
[1]
sorted: date ▼
$ grep
/
difficulty
medium
clear ✕
name
diff
os
date
tags
Browsed
medium
linux
2026-01-10
Malicious Chrome MV3 extension uploaded to server-side browser achieved RCE via bash arithmetic evaluation in a Flask/bash backend, then escalated to root via .pyc injection into a world-writable __pycache__ directory of a sudo-allowed Python script.
chrome extension
·
bash arithmetic evaluation
·
python pyc injection
·
sudo abuse
·
gitea
·
flask
no machines match that filter