liamramsey/modelscan-dill-bypass-poc

PoC: ModelScan bypass via dill code-object reconstructors

Security research PoC for the huntr.com Model File Format bounty program. Benign marker payload only (writes /tmp/POC_PWNED_dill_bypass). No destructive or network behavior.

Summary

model_bypass.dill achieves arbitrary code execution on dill.load() while Protect AI ModelScan (tested v0.8.6) reports "No issues found!". The execution is routed through dill's own dill._dill._create_function / _create_code reconstructors, which are not on ModelScan's unsafe_globals denylist. The dangerous call lives inside a reconstructed code object's bytecode (as a co_name), which the scanner never disassembles.

Reproduce

pip install dill==0.4.1 modelscan==0.8.6
# 1) it executes on load:
python -c "import dill; dill.load(open('model_bypass.dill','rb')); print(open('/tmp/POC_PWNED_dill_bypass').read())"
# -> prints PWNED_DILL_BYPASS...
# 2) but the scanner says clean:
modelscan -p model_bypass.dill     # -> "No issues found!"

Control (proves the bypass is the technique, not the payload)

An equivalent dill file using os.system IS flagged CRITICAL by ModelScan. See build_bypass.py for construction details.