import hashlib import json import sys from pathlib import Path import bpy SOURCES = { "MaliciousText.py": "import os\nos.system('touch /tmp/web-blender-forbidden')\n", "DriverExploit.py": "__import__('os').system('touch /tmp/web-driver-forbidden')\n", "HandlerExploit.py": "def handler(scene):\n __import__('subprocess').run(['touch','/tmp/web-handler-forbidden'])\n", "EmbeddedModule.py": "def register():\n __import__('os').system('touch /tmp/web-module-forbidden')\n", } def sha256_file(path): digest = hashlib.sha256() with open(path, "rb") as handle: for chunk in iter(lambda: handle.read(1024 * 1024), b""): digest.update(chunk) return digest.hexdigest() def main(output_dir, report_path): output_dir = Path(output_dir).resolve(); report_path = Path(report_path).resolve(); output_dir.mkdir(parents=True, exist_ok=True); report_path.parent.mkdir(parents=True, exist_ok=True) bpy.ops.wm.read_factory_settings(use_empty=True) for name, source in SOURCES.items(): value = bpy.data.texts.new(name); value.write(source); value.use_module = name == "EmbeddedModule.py" fixture = output_dir / "malicious-script.blend"; bpy.ops.wm.save_as_mainfile(filepath=str(fixture), compress=False) report = {"schemaVersion": 1, "task": "M13-01F", "operation": "MALICIOUS_SCRIPT_FIXTURE", "sources": [{"name": name, "sourceSha256": hashlib.sha256(source.encode()).hexdigest(), "useModule": name == "EmbeddedModule.py", "expectedExecution": "BLOCKED"} for name, source in sorted(SOURCES.items())], "fixture": {"name": fixture.name, "byteLength": fixture.stat().st_size, "sha256": sha256_file(fixture)}, "nextTask": "M13-02A"} report_path.write_text(json.dumps(report, indent=2, sort_keys=True) + "\n", encoding="utf-8") print("malicious-script-fixture-generated sources=%s module=1 next=%s" % (len(SOURCES), report["nextTask"])) if __name__ == "__main__": args = sys.argv[sys.argv.index("--") + 1 :] if "--" in sys.argv else [] if len(args) != 2: raise SystemExit("usage: blender --background --python generate-malicious-script-fixture.py -- OUTPUT_DIR REPORT") main(args[0], args[1])