modelscan-bypass-ctypes-getitem
PoC: Bypassing modelscan (protectai/modelscan) pickle scanner via ctypes.CDLL + operator.getitem.
Technique
Instead of using Python-level exec/eval (which modelscan blocks), this approach:
- Uses
ctypes.CDLL('libc.so.6') to load the C standard library
- Accesses
libc.system() via operator.getitem(libc, 'system') (uses __getitem__, not blocked)
- Calls
system(b'cmd') for arbitrary shell execution
Impact
- CVSS 9.8 — Remote Code Execution via malicious pickle file
- modelscan <= 0.8.8 completely undetectable
- Root cause: ctypes module entirely missing from blocklist; operator.getitem not covered
PoC File
ctypes_bypass.pkl — 130-byte pickle payload that executes arbitrary shell commands.
