Insecure Deserialisation

Web Application Pentesting > Advanced Server-Side Attacks > Insecure Deserialisation

Task 1

Introduction

1. I am ready to start the room.

No answer needed

Some important concepts

1. What is the function used in PHP for serialisation?

serialize()

2. What is the base score for the vulnerability CVE-2015-4852?

7.5

3. Does serialisation allow only saving to a byte stream file? (yea/nay)

nay

Serialisation Formats

1. What is the base64 encoded output after pickling the string You got it in Python? Utilise the notes app found at http://MACHINE_IP:5000.

gASVNQAAAAAAAACMCF9fbWFpbl9flIwFTm90ZXOUk5QpgZR9lIwFbm90ZXOUXZSMCllvdSBnb3QgaXSUYXNiLg==

2. What is the output after serialising the string You got it in PHP?

O:5:"Notes":1:{s:7:"content";s:10:"You got it";}

3. What is the renowned binary serialisation module used in Ruby?

Marshal

Identification

1. Visit the URL http://MACHINE_IP/who/index.php and identify what is the user-defined function used for serialisation?

HelloTHMSerialization

Explotation - Update properties

1. What is the flag value after sharing a note with a valid subscription?

THM{10101}

2. What is the default role value once the user loads the notes application?

guest

Explotation - Object injection

1. What is the flag value after getting the reverse shell?

THM{GOT_THE_SH#LL}

2. What is the output of the whoami command after getting the shell?

www-data

Automation Scripts

1. What is the vector for exploiting CodeIgniter4/FR1 as per the PHPGGC?

__toString

2. What is the output of the whoami command on the vulnerable Laravel application?

root

3. What is the output of the uname -r command on the vulnerable Laravel application?

5.15.0-1075-aws

Mitigation Measures

1. Is it a good practice to blindly use the eval() function in your code? (yea/nay)

nay

Conclusion

1. I have successfully completed the room.

No answer needed