Advanced PHP Deserialization - Phar Files

00:27 - Little bit of history about PHP Serialization
02:13 - Why is uploading Phar Files different than normal file upload vulns?
02:42 - What are Phar Files?
03:38 - Prevention by disabling the phar stream wrapper
04:00 - Going over the PHP Upload script created for this video
06:15 - Reviewing a PHP Script to generate malicious PHAR Files
07:20 - Setting our PHP Config to allow PHAR to operate in Read/Write mode
08:00 - Showing we can control the beginning bytes of the PHAR File to trick magic byte checks
08:40 - Copying the logging class from the intro to deserialization video into our upload script
09:35 - Adding the PHP Object/POP Chain to our PHAR Generation Script
11:30 - Starting a PHP Webserver so we can upload our image
12:20 - Explaining why the existing image upload script, isn't vulnerable.
13:00 - Creating a seperate script which performs the file operation unlink() against user input
14:45 - Trying to trigger this vulnerability via Curl (doesn't work yet, forgot to include our PHP Class)
16:00 - Adding the PHP Object to our script
17:17 - Begin of adding a phar file to a legitimate image
19:00 - Modifying our PHAR File to also be a valid image
20:12 - Triggering the PHAR Unserialize with our image, but this time with a different file operation (md5_file)
21:50 - Mentioning PHPGGC which is handy to utilize with this exploit
22:13 - Showing how to unregister PHP Stream wrappers to prevent this attack

[DividesByZer]

I love when you do videos that go into specific subjects like this. 👍

[SomeGuyInSandy]

Thank you for including a way to eliminate this vulnerability!

[maxmusterspace]

Can I get a IppSec-Tshirt with the quote: "I expected code execution...#sadface" ?? xD That tone of voice was just perfect. ;D

[neoXXquick]

Amazing video.. i would like if you could continue this series..

[adhilazeez]

Great content 👍. All your videos are awsome. And really thanks for your support 👍

[khneo]

Thank you, your last video are really cool ! I hope you will do more like that !

I just have a question : in a black box testing, is there a way to know that there is a vulnerability or do you just try it and see if it works ?

[supercoolgames]

Thanks heaps for this, very interesting.

I am just wondering, how are the methods "unlink", "md5sum" triggering the destruct magic method of the object you're creating? Is is apart of the phar:// read processing? When is the object unset?

When is it possible to use phar://, only with methods that involve reading data?

[khalat]

Hi. Would be great to have a little bit more volume on the audio. Otherwise, really great.

[rawbytes]

Its been 2yrs of this video, learned a lot from it. But it somehow doesn't work with php 8.1, it works good with php 7.4 . I think they changed something in new update so it doesn't work. I spend to find why it is not working (I was working with php8.1), then ran it with php7.4 and voila, magic happened. Thanks for such quality learning meterial...

[xcffee_]

You can't do this if you don't know the name of the class that's already present on the server, right?

[nickomode]

when will you do smasher2? is there going to be unintended routes in the video

[TheMrchement]

Can you teach me step by step for ethical hacking or pentesting

[Matthe]

What application do you use to edit phar file