phpggc - PHPGGC is a library of PHP unserialize() payloads

项目说明

PHPGGC: PHP Generic Gadget Chains

*PHPGGC is a library of unserialize() payloads along with a 工具 to generate them, from command line or programmatically*.
When encountering an unserialize on a website you don't have the 代码 of, or simply when trying to build an exploit, this 工具 allows you to generate the payload without having to go through the tedious steps of finding gadgets and combining them. It can be seen as the equi of frohoff's ysoserial, but for PHP.
Currently, the 工具 supports gadget chains such as: CodeIgniter4, Doctrine, Drupal7, Guzzle, Laravel, Magento, Monolog, Phalcon, Podio, Slim, SwiftMailer, Symfony, Wordpress, Yii and ZendFramework.

Requirements

PHP >= 5.6 is required to run PHPGGC.

Usage

Run ./phpggc -l to obtain a list of gadget chains:

Filter gadget chains:

Every gadget chain has:

Use -i to get detailed information about a chain:

For RCE gadgets, the executed command can have 3 formatting types depending on how the gadget works:

Once you ha a chain, run ./phpggc <gadget-chain> [parameters] to obtain the payload.
For instance, to obtain a payload for Monolog, you'd do:

For a file write using SwiftMailer, you'd do:

Wrapper

The --wrapper (-w) option allows you to define a PHP file containing the following functions:

For instance, if the 代码 looks like this:

You could use a __toString() chain, wrapping it like so:

And you'd call phpggc like so:

PHAR(GGC)

History

At BlackHat US 2018, released PHARGGC, a fork of PHPGGC which instead of building a serialized payload, builds a whole PHAR file. This PHAR file contains serialized data and as such can be used for exploitation techniques (file_exists, fopen, etc.). The paper is here.

Implementation

PHAR archives come in three different formats: PHAR, TAR, and ZIP. The three of them are supported by PHPGGC.
Polyglot files can be generated using --phar-jpeg (-pj). Other options are a (use -h).

Examples

Encoders

Arguments allow to modify the way the payload is output. For instance, -u will URL encode it, and -b will convert it to base64.
Payloads often contain NULL bytes and cannot be copy/pasted as-is. Use -s for a soft URL encode, which keeps the payload readable.

The encoders can be chained, and as such the order is important. For instance, ./phpggc -b -u -u slim/rce1 system id will base64 the payload, then URLencode it twice.

Ad: Enhancements

Fast destruct

PHPGGC implements a --fast-destruct (-f) flag, that will make sure your serialized object will be destroyed right after the unserialize() call, and not at the end of the script. I'd recommend using it for every __destruct , as it impro. For instance, if PHP script raises an exception after the call, the __destruct method of your object might not be called. As it is processed at the same time as encoders, it needs to be set first.

ASCII Strings

Uses the S serialization format instead of the standard s. This replaces every non-ASCII char to an hexadecimal representation:
s:5:"A<null_byte>B<cr><lf>";̀ -> S:5:"A\00B\09\0D";
This can be useful when for some reason non-ascii characters are not allowed (NULL BYTE for instance). Since payloads generally contain them, this makes sure that the payload consists only of ASCII .
*Note: this is experimental and it might not work in some cases.*

Armor Strings

Uses the S serialization format instead of the standard s. This replaces every char to an hexadecimal representation:
s:5:"A<null_byte>B<cr><lf>";̀ -> S:5:"\41\00\42\09\0D";
This comes handy when a firewall or PHP 代码 blocks strings.
*Note: this is experimental and it might not work in some cases.*
*Note: this makes each string in the payload grow by a factor of 3.*

Plus Numbers

Sometimes, PHP scripts that the gi payload does not contain objects by using a regex such as /O:[0-9]+:. This is easily bypassed using O:+123:... instead of O:123:. One can use --plus-numbers <types>, or -n <types>, to automatically add these + signs in front of symbols.
For instance, to obfuscate objects and strings, one can use: --n Os. Please note that since PHP 7.2, only i and d (float) types can have a +.

Public Properties

Attempts to convert references to protected or private properties within the serialized payload to public.
This can be useful because when PHP serializes a non-public property of an object it prepends the property name with an asterisk (for protected) or the class name (for private) surrounded by null bytes, which are easy to lose if the payload is transmitted or stored as plain text without encoding. If that happens, the payload will fail to unserialize because the string length of the property name (and the name itself) will be incorrect.
As an added bonus, payloads are slightly smaller without the prefixes. Con properties to public tends to work in more recent PHP but can cause problems in older (before PHP 7.2).
This functionality may not work properly if a chain includes one or more objects that have a custom serialize / unserialize implementation.

Testing your chain

To test if the gadget chain you want to use works in the targeted en, jump to your en's folder and run the chain argument-free, with the --test-payload option.

For instance, to test if Monolog/RCE2 works on Symfony 4.x:

The exit code will be 0 if the payload triggered, 1 otherwise.

Testing your chain against every of a package

If you wish to know which of a package a gadget chain works against, you can use test-gc-compatibility.py.

You can specify the you want to test by using the following syntaxe.

API

Instead of using PHPGGC as a command line 工具, you can program PHP scripts:

This allows you to tweak the parameters or write exploits more easily.
*Note: This is pretty experimental at the moment, so please, report bugs*.

Contributing

Pull requests are more than welcome. Please follow these simple guidelines:

Codewise, the directory structure is fairly straightforward: gadgets in _gadgets.php_, description + logic in _chain.php_.
You can define pre- and post- processing methods, if parameters need to be modified.
Hopefully, the already implemented gadgets should be enough for you to build yours.
Otherwise, I'd be glad to answer your questions.

Please test as many as you can. The nomenclature for is as such: [-]<lower-> <= <higher->[+]. The - and + signs indicate that your payload may work on respectively lower and higher . For instance, if your gadget chain works from 2.0.0 to 4.4.1, which is the last at the time, use 2.0.0 <= 4.4.1+.

The --new <framework> <type> command-line option can be used to create the directory and file structure for a new gadget chain.
For instance, use ./phpggc -n Drupal RCE would create a new Drupal RCE gadgetchain.

Docker

If you don't want to install PHP, you can build a docker image using:

You can then used the dockerized phpggc.

To generate a gadget chain

To test a chain

Jump to your en's folder and run the chain argument-free, with the --test-payload option:

To generate phar / polyglot files

> Note: The command must be executed in the directory where the input image is located.

To run test-gc-compatibility.py

License

Apache License 2.0

项目信息

开发语言：PHP

Star 数：3893

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕PHPGGC is a library of PHP unserialize() payloads along with a 工具 to generate them, from command line or programmatically. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。