neko
7fecd435cc
Exploits the interaction between php_serialize and php session handlers: when one endpoint writes sessions with php_serialize (Laravel, Symfony default) and another reads with the php handler (PHP default), injected pipe characters cause arbitrary deserialization at session_start(). 12 built-in POP chains covering current and legacy library versions: - monolog3-fw: Monolog 3.0+ (tested 3.12.1, latest) - laravel10-cmd/fw: illuminate 10.0-13.x+ (tested v13.38.0, latest) - monolog-cmd/fw: Monolog 1.17.2-2.x - laravel-cmd/fw: illuminate 5.4-8.x - guzzle-fw: Guzzle 4.0-7.x - symfony-cmd/fw: Symfony 2.6-4.4.18 - wordpress-cmd/fw: WordPress 6.4.0-6.4.1 All chains tested end-to-end through the full HTTP exploit flow on PHP 8.3. Accepts custom phpggc chains via --chain-file.
19 lines
556 B
PHP
19 lines
556 B
PHP
<?php
|
|
/**
|
|
* Test endpoint: default php handler.
|
|
* Just calls session_start(). The handler mismatch causes
|
|
* deserialization of objects injected via the php_serialize endpoint.
|
|
*
|
|
* In the wild, this maps to any PHP script on the same host that:
|
|
* - Does NOT set session.serialize_handler to php_serialize
|
|
* - Calls session_start()
|
|
* (phpMyAdmin, legacy scripts, admin panels, etc.)
|
|
*
|
|
* Autoloads Monolog so deserialized objects have real classes.
|
|
*/
|
|
require __DIR__ . '/vendor/autoload.php';
|
|
|
|
session_start();
|
|
|
|
echo "OK pid=" . getmypid();
|