Vulnerabilidades en PHP: Unserialización con 'phar://', Diapositivas de Programación Funcional

¡Descarga Vulnerabilidades en PHP: Unserialización con 'phar://' y más Diapositivas en PDF de Programación Funcional solo en Docsity!

“It’s a PHP unserialization vulnerability Jim,

but not as we know it”

Sam Thomas

WHOAMI

• Director of Research at Secarma Ltd
• Research / Application Assessments / Red Teaming

Introduction

Code reuse

ROP POP

ret2libc

Return Oriented Programming Property Oriented Programming

Introduction

• Unserialize is called on attacker controlled input
• Once object is unserialized from input (and when it is destroyed) certain “magic” methods are called
• In favourable circumstances properties and methods can be chained together to cause malicious actions to occur
• TL/DR = Unserialization is bad

https://www.xkcd.com/293/

XKCD 293 – RTFM

Stream Wrappers

file:// http:// ftp:// php:// zlib:// data:// glob:// phar://

[3]

Stream Wrappers

• LFI
  • LFI - > From STDIO: php://input [4]
  • LFI - > Source code reading: php://filter/convert.base64-encode/resource=index.php [4]
• File writing
  • Similar to source code reading, if we have a file write vulnerability which writes undesirable content (e.g. “<?php die()” before our controlled value) we can base64 decode it [5] file:// http:// ftp:// php:// zlib:// data:// glob:// phar:// Remote Input & Filtering

Stream Wrappers

• Not used with normal file operations  file:// http:// ftp:// php:// zlib:// data:// glob:// phar:// Remote Input & Filtering Directory Listing

[6]

Stream Wrappers

• Exploit vulnerabilities in native code? file:// http:// ftp:// php:// zlib:// data:// glob:// phar:// Remote Input & Filtering Directory Listing Archive

[7]

[8]

[7]