3 php file injection (deserialization exploit)

http://10.10.10.223/sator.php.bak
<?php
class DatabaseExport
{
        public $user_file = 'users.txt';
        public $data = '';
        public function update_db()
        {
                echo '[+] Grabbing users from text file <br>';
                $this-> data = 'Success';
        }
        public function __destruct()
        {
                file_put_contents(__DIR__ . '/' . $this ->user_file, $this->data);
                echo '[] Database updated <br>';
        //      echo 'Gotta get this working properly...';
        }
}
$input = $_GET['arepo'] ?? '';
$databaseupdate = unserialize($input);
$app = new DatabaseExport;
$app -> update_db();
?>

Using https://medium.com/swlh/exploiting-php-deserialization-56d71f03282a

  • We understand the we need to pass arepo= (some serialized string);

  • func __destruct calls file_put_contents basically making a new file with the $user_file as name and $data as its contents.

  • We can exploit this by creating our own serialized class.

Trying out http://10.10.10.223/webshell.php?cmd=whoami

Lets get a reverse-shell:

Previous4 privescNext2 :80 wordpress

Last updated