8000 Fix compatibility with Python 3.13 (crypt module removal & deprecated import logic) by Chocapikk · Pull Request #296 · calebstewart/pwncat · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Fix compatibility with Python 3.13 (crypt module removal & deprecated import logic) #296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix compatibility with Python 3.13 (crypt module removal & deprecated import logic) #296

wants to merge 2 commits into from

Conversation

Chocapikk
Copy link
@Chocapikk Chocapikk commented Apr 5, 2025 •
edited
Loading

This PR fixes pwncat compatibility with Python 3.13 by addressing five key issues:

Fixes included

Module replacement

  • Removed use of deprecated crypt module (dropped in Python 3.13)
  • Replaced with passlib.hash.sha512_crypt for hashing /etc/passwd entries
    → Updated in:
    • modules/linux/enumerate/escalate/append_passwd.py
    • modules/linux/implant/passwd.py

Import system cleanup

  • Replaced deprecated: 
    loader.find_module(...).load_module(...)
    with: 
    importlib.util.spec_from_loader(...) + exec_module(...)
    → Applied in:
    • pwncat/commands/__init__.py
    • pwncat/manager.py

CVE-2019-14287 detection fix

  • Made the version parsing more robust using try/except with packaging.version.parse()
    → Prevents crashes on systems with distro-specific or malformed sudo versions.

Pickle serialization fix

  • Fixed a bug introduced in a previous commit that broke object serialization with ZODB
    → Restores proper enumeration, persistence, and database commits.

Dependency update

  • Added passlib to pyproject.toml to support the new password hashing backend.

Errors resolved

  • ModuleNotFoundError: No module named 'crypt'
  • AttributeError: 'FileFinder' object has no attribute 'find_module'
  • PicklingError: Can't pickle <class ...>

How to install this fix immediately

If this PR is not yet merged, you can install the fixed version directly from my fork:

pipx install git+https://github.com/Chocapikk/pwncat-vl

@Chocapikk
fix: add compatibility with Python 3.13 (fix distutils, find_module, …
6ac5afd 
…crypt)

- Replaced deprecated `find_module` usage in `CommandParser` and `Manager` by `importlib.util.module_from_spec` and `exec_module`
  (fixes AttributeError: 'FileFinder' object has no attribute 'find_module')

- Replaced `crypt.crypt(...)` with `passlib.hash.sha512_crypt` for password hashing
  (fixes ModuleNotFoundError: No module named 'crypt')

- Added `passlib` as a dependency in `pyproject.toml` under [tool.poetry.dependencies]
  (fixes ModuleNotFoundError: No module named 'passlib')
@Chocapikk Chocapikk force-pushed the master branch 2 times, most recently from 63b2df4 to 9f81b10 Compare April 5, 2025 20:13
@Chocapikk
fix(enumerate): fix CVE-2019-14287 detection and restore pickle compa…
a6b4b5a 
…tibility

Fixed CVE-2019-14287 detection logic.

Also reverted a previous accidental change that broke pickle serialization, preventing persistent storage from working properly.
@Yakui420
Copy link
Yakui420 commented May 25, 2025 •
edited
Loading

Are you also getting an error when trying to get a shell from a windows target?

I get this:

[12:05:36] received connection from 10.10.100.15:49331         
[12:06:06] connection failed: channel receive timed out: b"Invoke-Expression : The
           term 'stty' is not recognized as the name of a cmdlet, function, script
           file, or operable \r\nprogram. Check the spelling of the name, or if a
           path was included, verify that the path is correct and try again.\r\nAt
           line:1 char:501\r\n+ ... BytesRead - 1);$Output = try {Invoke-Expression
           $Command 2>&1 | Out-S ...\r\n+
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          :
           ObjectNotFound: (stty:String) [Invoke-Expression],
           CommandNotFoundException\r\n    + FullyQualifiedErrorId : CommandNotFoun
           dException,Microsoft.PowerShell.Commands.InvokeExpressionCommand\r\n
           \r\n"
(local) pwncat$

@Chocapikk
Copy link
Author

Hey @Yakui420 , I haven't looked or tested it on Windows environments. But I just think that this payload is not compatible with the env. It says that a command cannot be found, I think it's "stty" here, you will have to add an alternative payload for the interactive shell.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Chocapikk @Yakui420
0