xiaoyaoes/pickle-bypass-distutils-spawn-poc

Pickle Scanner Bypass — distutils.spawn.spawn

RCE via deprecated stdlib distutils.spawn.spawn()

Bypasses both picklescan v1.0.4 and modelscan v0.8.8.

The deprecated distutils.spawn.spawn() function internally calls subprocess.Popen(cmd).wait(), executing arbitrary commands. Neither scanner includes distutils.spawn in their unsafe modules list.

Usage

python3 -c "import pickle; pickle.load(open('malicious.pkl', 'rb'))"
# /tmp/MFV_PWNED will be created

Technical Details

• Module: distutils.spawn (stdlib, deprecated since Python 3.10, removed in 3.12)
• Function: distutils.spawn.spawn()
• Attack: distutils.spawn.spawn(['bash', '-c', 'your_command_here'])
• Detection: picklescan v1.0.4: ❌ | modelscan v0.8.8: ❌

distutils.spawn is distinct from distutils.file_util (which is in picklescan's blocklist).