I'm working on a challenge that was presented to me without much prior knowledge of Python and the pickle library.

I'm unable to post the challenge's code for reasons. In short though I am accessing a web app that allows for user's to upload files of any type and size.

The code given to me then creates an object for the file that contains user information (my actual username for the website), content type, and the data of the file.

The web application then creates a file handle for writing to effectively put the serialized data into the file on the system.

For example:

f = open(filename, 'w')
pickle.dump(fileObject ,f)

From my understanding of pickle.load based on what I read it takes the object and produces strings / tuples that contain the information provided from the file I uploaded.

I would imagine I would then use pickle.load(filehandle) to unserialize (deserialize?) the file and perform the remote code execution of gaining a reverse shell or whatever it is I'd like to do.

However, when I supply code to the file I uploaded, and I try to have the pickle.load get called from the file download function I never see what I expect. I usually just get the contents of my uploaded file back to me without code execution.

I am typically uploading a file with the following contents:

import os

class Exploit:
   def __init():

   def executePayload()
      return os.system("/bin/echo blah")

Do I need to include something myself that will then serialize the above code again and then something to unserialize it?

I found the following question over on stackoverflow: https://stackoverflow.com/questions/57099631/how-to-implement-code-execution-via-reduce-for-pickling that made me think I need to do make a payload that creates a payload.

I'd appreciate if someone could provide reading materials to better understand what's happening or just an easy to follow explanation + example.

  • 1
    To those considering voting to close this question as off topic because it could be considered as asking to break the security of a specific system: this challenge is as basic as Python object injection / deserialise bugs get. In fact, one could consider it to be the standard demonstration of this bug class for Python. As such I think there is no discernable difference between this "specific system" and the generic bug class example, so it is a valid question. – Polynomial Jul 24 at 21:56
  • The __recuce__ function is key for the pickle exploit. It get's called when your payload gets deserialized. For a easy to follow example have a look at ippsecs video walkthrough for the DevOops Machine at hackthebox: youtube.com/watch?v=tQ34Ntkr7H4&t=695s – mhr Jul 25 at 7:03
  • There is an awesome paper about pickle shellcoding by Marco Slaviero. It's very detailed and you can find it here! – game0ver Jul 25 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.