PortSwiggerlabs: Using application functionality to exploit insecure deserialization

Information :

This lab uses a serialization-based session mechanism. A certain feature invokes a dangerous method on data provided in a serialized object. To solve the lab, edit the serialized object in the session cookie and use it to delete the morale.txt file from Carlos’s home directory.

You can log in to your own account using the following credentials: wiener:peter

You also have access to a backup account: gregg:rosebud

Solution :

First we login to the app as the wiener user :

We see that we have the ablity to delete our user . Let’s try deleting our user then check Burp :

If we had Burp pro we will get a flag that there is a serializable object inside the request , but in our case we will just use Inspector and from there we can see that the cookie we get is a PHP serializable object :

O:4:"User":3:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"pxzxy52y06syyfesirzosl3q041a6wy7";s:11:"avatar_link";s:19:"users/wiener/avatar";}

Looking at the cookie , we see that the avatar link is actually tied to our home directory , we need to delete the file morale.txt file from carlos’s directory .

Let’s modify the cookie :

O:4:"User":3:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"pxzxy52y06syyfesirzosl3q041a6wy7";s:11:"avatar_link";s:23:"users/carlos/morale.txt";}

Notice that users/carlos/morale.txt has 23 characters so we must change the s:19 to 23 otherwise it’ll break :

Now first we login as the backup acc , Greg :

Then from there we click on delete and intercept the request :

Once we do that , we should forwad the requests and from there we will see that we solved the lab :

That was all for this lab , see you in the next one :)