CVE-2022-35411

This exploit leverages insecure deserialization in rpc.py (versions 0.4.2 to 0.6.0) by sending a malicious pickle payload to execute arbitrary commands. The payload abuses Python's pickle deserialization to trigger `os.system` with attacker-controlled input.

This repository contains a functional exploit for CVE-2022-35411, targeting unauthenticated RCE in rpc.py via unsafe pickle deserialization. The exploit includes a reverse shell payload and a dry-run mode for testing.

This repository contains a functional exploit for CVE-2022-35411, leveraging insecure deserialization in rpc.py versions 0.4.2 to 0.6.0. The exploit uses Python's pickle module to craft a malicious payload that achieves remote code execution (RCE) via the 'serializer' header.

This repository contains a functional exploit for CVE-2022-35411, targeting a deserialization vulnerability in rpc.py versions 0.4.2 to 0.6.0. The exploit leverages Python's pickle deserialization to achieve unauthenticated remote code execution (RCE) by sending a crafted payload to the vulnerable endpoint.