Pip Download Code Execution
Theory
Pip is a package management system written in Python. It can download custom Python package so we can create a malicious package to execute arbitrary code.
Practice
Assume that pipe download can be executed as root with sudo rights. if we controll its input, then its vulnerable to arbitrary code execution.
sudo -l
(root): /usr/bin/pip3 download http\://*.tar.gz