modelscan-bypass-ctypes-getitem

PoC: Bypassing modelscan (protectai/modelscan) pickle scanner via ctypes.CDLL + operator.getitem.

Technique

Instead of using Python-level exec/eval (which modelscan blocks), this approach:

1. Uses ctypes.CDLL('libc.so.6') to load the C standard library
2. Accesses libc.system() via operator.getitem(libc, 'system') (uses __getitem__, not blocked)
3. Calls system(b'cmd') for arbitrary shell execution

Impact

• CVSS 9.8 — Remote Code Execution via malicious pickle file
• modelscan <= 0.8.8 completely undetectable
• Root cause: ctypes module entirely missing from blocklist; operator.getitem not covered

PoC File

ctypes_bypass.pkl — 130-byte pickle payload that executes arbitrary shell commands.