liamramsey/modelscan-torchpackage-bypass-poc

PoC: ACE in torch.package PackageImporter via interned source (ModelScan bypass)

Security research PoC for the huntr.com Model File Format bounty program. Benign marker payload only (writes /tmp/POC2_PWNED_torch_package). No destructive or network behavior.

Summary

malicious.pt is a torch.package archive. torch.package serializes Python module source into the .pt. When loaded with the normal public API PackageImporter(file).load_pickle(pkg, resource), the importer calls compile() + exec() on the interned source, so a top-level statement in the packaged .py runs at load time. Protect AI ModelScan (v0.8.6) only disassembles pickle bytecode and explicitly skips the .py source files, so it reports "No issues found!" on this live-RCE file.

Reproduce

pip install torch==2.8.0 modelscan==0.8.6
# 1) it executes on load:
python -c "from torch.package import PackageImporter; PackageImporter('malicious.pt').load_pickle('data','model.pkl'); print(open('/tmp/POC2_PWNED_torch_package').read())"
# -> prints PWNED_torch_package...
# 2) but the scanner says clean:
modelscan -p malicious.pt          # -> "No issues found!"
modelscan -p malicious.pt --show-skipped   # -> the payload .py is "skipped"

Control

The identical os.system payload placed in the pickle (via __reduce__) inside a torch.package archive IS flagged CRITICAL by ModelScan — proving the bypass is the interned-source exec path, not the payload. See build_poc.py.