On this past Thursday we spoke at BlackHat USA on Python Pickle. In the presentation, we covered approaches for implementing missing functionality in Pickle, automating the conversion of Python calls into Pickle opcodes, scenarios in which attacks are possible and guidelines for writing shellcode. Two tools were released:
- Converttopickle.py – automates conversion from Python-like statements into shellcode.
- Anapickle – helps with the creation of malicious pickles. Contains the shellcode library.
Lastly, we demonstrated bugs in a library, a piece of security software, typical web apps, peer-to-peer software and a privesc bug on RHEL6.
Slides are available below, the whitepaper is here and tools here.