PortSwiggerlabs: Arbitrary object injection in PHP

Information :

This lab uses a serialization-based session mechanism and is vulnerable to arbitrary object injection as a result. To solve the lab, create and inject a malicious serialized object to delete the morale.txt file from Carlos’s home directory. You will need to obtain source code access to solve this lab.

You can log in to your own account using the following credentials: wiener:peter

Solution :

First we login as wiener , then check Burp Site map to see different endpoints .

Now checking Burp :

We notice this template.php file , if we send it to Repeater :

To be able to read files using Repeater , we can add a ~ to the file name :

Perfect we are able to read the file .

If we check the destrcut function :

function __destruct() {
        // Carlos thought this would be a good idea
        if (file_exists($this->lock_file_path)) {
            unlink($this->lock_file_path);
        }
    }

This is the way we’re going to delete the morale.txt file . Looking back at the code :

class CustomTemplate {
    private $template_file_path;
    private $lock_file_path;

We can create a new CustomTemplate Object , with the $lock_file_path , we need to make sure we don’t make any errors when creating the serialized object :

O:14:"CustomTemplate":1:{s:14:"lock_file_path";s:23:"/home/carlos/morale.txt";}

Now first we Base64 encode it then we URL encode it just like we see in Inspector everytime we find a php serialized object.

This is our new payload :

TzoxNDoiQ3VzdG9tVGVtcGxhdGUiOjE6e3M6MTQ6ImxvY2tfZmlsZV9wYXRoIjtzOjIzOiIvaG9tZS9jYXJsb3MvbW9yYWxlLnR4dCI7fQo%3D

Now back at Burp , we see that once we login we have a new session cookie , which is also just a serialized object :

Now we can send any request that has this cookie to repeater , then modify the cookie to our new value , and this will automatically trigger the __destruct() method since we’ve specified the lock_fle_path in the serialized object :

Now if we change the cookie :

We see that the lab was solved .

That was all for this lab , see you in the next one :)