It looks like you're new here. If you want to get involved, click one of these buttons!
#!/usr/bin/pythonimport sys, pickle, oscmd = '/bin/sh'out = open('file.pkl', 'wb')pickle.dump(cmd, out)out.close()file = open('file.pkl', 'rb')data = pickle.load(file)file.close()os.system(data)
and arbitrary code can be executed while unpickling
said:and arbitrary code can be executed while unpicklingi'm confused, are you saying arbitrary code can be involuntarily executed when loading in the pickle'd file? or just by using the system function? also cpickle > pickle, just saying.