Intro to PHP Deserialization / Object Injection

Name: Intro to PHP Deserialization / Object Injection
Uploaded: 2019-12-21T11:45:04Z
Channel: IppSec
Description: 00:50 - Background information, showing variables are point in time 03:40 - Creating a PHP Class and Object 05:40 - Serializing the Object and going ove...

IppSec · Beginner ·🛡️ AI Safety & Ethics ·6y ago

00:50 - Background information, showing variables are point in time 03:40 - Creating a PHP Class and Object 05:40 - Serializing the Object and going over the format 07:40 - Converting the script to accept a PHP Object via WebRequest 09:20 - Explaining PHP Desesrialization Gadgets 10:05 - Creating Attack.php in order to quickly generate PHP Objects 11:30 - Creating exploit.sh which will just send our malicious object to the webserver 12:45 - Going over PHP Magic Methods 13:15 - Adding the __toString class that we can create a gadget to get to in order to read files 15:00 - Adding the new class …

Watch on YouTube ↗ (saves to browser)

Chapters (18)

0:50 Background information, showing variables are point in time

3:40 Creating a PHP Class and Object

5:40 Serializing the Object and going over the format

7:40 Converting the script to accept a PHP Object via WebRequest

9:20 Explaining PHP Desesrialization Gadgets

10:05 Creating Attack.php in order to quickly generate PHP Objects

11:30 Creating exploit.sh which will just send our malicious object to the webserver

12:45 Going over PHP Magic Methods

13:15 Adding the __toString class that we can create a gadget to get to in order to

15:00 Adding the new class to our attack script and reading /etc/passwd

17:40 Demonstrating "Class Path" by creating an __destruct() method in another php f

19:00 Adding the LogFile to our class path and using it to drop a file

20:00 Didn't work! Our script errored and PHP never destroyed our object so code did

21:00 Moving the LogFile gadget to our isAdmin check, which works

21:35 Demonstrating a way to do Fast Destruct, to immediately destroy the object...

25:14 Showing if an function is called from another functions magic method, we can c

25:41 Adding pwned function to attack. This is prior to us having a magic method cal

27:20 Making ReadFile() call pwn when destroyed

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

Intro to PHP Deserialization / Object Injection

Chapters (18)

Playlist

Lesson complete!