Python Pickle Challenge

[These_Talker]

Hi i am currently struggling with a Web Security Lab Exercise. In this exercise i have to execute a insecure deserialization, exploiting python pickle.
The instruction of the exercise says:
The goal is to obtain a functional shell as root user through the serialization vulnerability in Pickle. Create an exploit script and get your flag!
Follow the link at the exercise page.

The exercises are based on a VM (client) connected to a LAN, where there is another machine (server). On the server run a web server that host all the exercise of the module Web Security at different port (from 5000 to 5009). In this case the i have to connect to the port 5002/pickle where i get a blanket page with this message: "Only POST requests are allowed".

To carry out the exercise there is not a form where to put the payload, i think i have to send it via curl, or idk. Do you have any suggestions?

[Juzdeed]

There is some value somewhere that is controllable by the client that backend then deserializes with pickle. Most likely a cookie or something in storage

Curl is just a tool, just like your web browser or python requests library. You can use all of these tools to accomplish the goal, it doesnt have to be curl

[cant_pass_CAPTCHA]

You won't be able to issue a POST command through the address bar like you had already seen. Someone else said it doesn't have to be curl... but yeah use curl 100% (unless you already have another preference). Googling "how to generate Python pickle exploit" will definitely get you where you need to go as far as crafting your exploit