PortSwiggerlabs: Modifying serialized objects

Information :

This lab uses a serialization-based session mechanism and is vulnerable to privilege escalation as a result. To solve the lab, edit the serialized object in the session cookie to exploit this vulnerability and gain administrative privileges. Then, delete the user carlos.

You can log in to your own account using the following credentials: wiener:peter

Solution :

First we login as the wiener user.

Then we check Burp’s sitemap to check all the endpoints :

We see that once we login we get a session cookie , looking at Inspector , we see that it contains some information about our user , the username as well as the role , in this case admin role is set to 0 .

Looking at the decoded value this is a PHP’s native serialization format :

• O:4:”User”:2:{…} → Object, class name is 4 characters long (“User”), and it has 2 properties
• s:8:”username” → a string property, 8 characters long, named “username”
• s:6:”wiener” → string value, 6 chars, “wiener”
• s:5:”admin” → string property name “admin”, 5 chars
• b:0 → boolean value, false

Now what we could try here is to change the boolean value to 1 , and see if we’re granted admin privileges .

First we send the request again then interecept it this time and modify the cookie using Inspector and forward the request :

Now first we login :

Then we modify the Cookie that we got :

We can do that using Inspector :

Now we just forward the rest :

And we are able to access the admin interface , we can see that now we’ve got an admin panel that we can visit :

Now to get the flag , we need to delete the user carlos , again , we need to intercept the request and modify the cookie whenever we want to perform any action as the admin , once we intercept it we modify the value to 1 for admin :

Then the final request as well :

Finally once we delete carlos , we should see that lab was solved :

Just make sure you modify the cookie in every request , you could automate it by using a match and replace rule , but since there are only few requests we can do it mmanually still .

That was all for this lab , see you in the next one :)