Advanced PHP Deserialization - Phar Files

Name: Advanced PHP Deserialization - Phar Files
Uploaded: 2019-12-23T01:44:47Z
Channel: IppSec
Description: Previous Video: Intro to PHP Deserialization - https://youtu.be/HaW15aMzBUM 00:27 - Little bit of history about PHP Serialization 02:13 - Why is uploadi...

IppSec · Beginner ·🛠️ AI Tools & Apps ·6y ago

Previous Video: Intro to PHP Deserialization - https://youtu.be/HaW15aMzBUM 00:27 - Little bit of history about PHP Serialization 02:13 - Why is uploading Phar Files different than normal file upload vulns? 02:42 - What are Phar Files? 03:38 - Prevention by disabling the phar stream wrapper 04:00 - Going over the PHP Upload script created for this video 06:15 - Reviewing a PHP Script to generate malicious PHAR Files 07:20 - Setting our PHP Config to allow PHAR to operate in Read/Write mode 08:00 - Showing we can control the beginning bytes of the PHAR File to trick magic byte checks 08:40 - Co…

Watch on YouTube ↗ (saves to browser)

Chapters (20)

0:27 Little bit of history about PHP Serialization

2:13 Why is uploading Phar Files different than normal file upload vulns?

2:42 What are Phar Files?

3:38 Prevention by disabling the phar stream wrapper

4:00 Going over the PHP Upload script created for this video

6:15 Reviewing a PHP Script to generate malicious PHAR Files

7:20 Setting our PHP Config to allow PHAR to operate in Read/Write mode

8:00 Showing we can control the beginning bytes of the PHAR File to trick magic byt

8:40 Copying the logging class from the intro to deserialization video into our upl

9:35 Adding the PHP Object/POP Chain to our PHAR Generation Script

11:30 Starting a PHP Webserver so we can upload our image

12:20 Explaining why the existing image upload script, isn't vulnerable.

13:00 Creating a seperate script which performs the file operation unlink() against

14:45 Trying to trigger this vulnerability via Curl (doesn't work yet, forgot to inc

16:00 Adding the PHP Object to our script

17:17 Begin of adding a phar file to a legitimate image

19:00 Modifying our PHAR File to also be a valid image

20:12 Triggering the PHAR Unserialize with our image, but this time with a different

21:50 Mentioning PHPGGC which is handy to utilize with this exploit

22:13 Showing how to unregister PHP Stream wrappers to prevent this attack

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

Advanced PHP Deserialization - Phar Files

Chapters (20)

Playlist

Lesson complete!