Pickle_Exploit

Demonstrating Remote Code Execution Vulnerability via Pickle Serialization in ClearML

🖥️ This script was developed by h3x0v3rl0rd.

This proof of concept (PoC) demonstrates a potential security vulnerability involving the serialization and deserialization of Python objects using the pickle library. Specifically, it creates a RunCommand class with a reduce method that, when deserialized, executes a reverse shell command via os.system. This command attempts to establish a reverse shell connection to a specified IP address and port. The PoC script uploads this maliciously crafted object as an artifact to a ClearML task, showcasing how such an object could be exploited if deserialized without proper validation.

This example underscores the importance of careful handling and validation of serialized data to prevent remote code execution attacks.

Warning: This code is intended for educational purposes only and should not be executed in a production environment or without appropriate permissions and security measures in place.