sfwani/mfv-getattr-static-bypass-joblib

MFV PoC: inspect.getattr_static Universal Bypass + Double BUILD Technique

WARNING: This repository contains proof-of-concept malicious model files for security research purposes only.

Vulnerability

Two novel pickle scanner bypass techniques:

Chain A: inspect.getattr_static (95 bytes)

chain_a_model.joblib uses inspect.getattr_static as a drop-in replacement for builtins.getattr that no scanner detects. Combined with importlib.import_module, it provides a universal import-to-function-call chain.

Chain B: Double BUILD (169 bytes)

chain_b_model.joblib uses a novel technique: two consecutive pickle BUILD opcodes on the same object. The first BUILD injects __setstate__ = exec into the object's __dict__, then the second BUILD triggers exec(code) because pickle's BUILD opcode calls __setstate__ if present.

Reproduction

import joblib
# Chain A: touch /tmp/pwned via os.system
model = joblib.load("chain_a_model.joblib")

# Chain B: touch /tmp/pwned via exec
model = joblib.load("chain_b_model.joblib")

Scanner Results (both chains)

• picklescan 1.0.4: 0 issues, 0 infected files
• modelscan: "No issues found"