About Me. Rohit Salecha

Size: px

Start display at page:

Download "About Me. Rohit Salecha"

Alfred Sanders
5 years ago
Views:

1 Serialization Bugs

2 About Me Rohit Salecha Senior Security NotSoSecure 7+ yrs of Corporate Experience Pentesting (Web, Mobile, Infra) and Development in Java Trainer : AppSec for Developers, Basic Web BlackHat USA (@salecharohit on social platforms)

3 What are we here for? What are Serialization Vulnerabilities (A7 -OWASP Top 2017)? Object Serialization in PHP Lab/Demo Binary and XML Serialization in Java Lab/Demo Serialization in Other Languages Learn how to find serialization bugs ( and how to exploit them)

4 Object Serialization Converting complex data structures like objects/arrays to strings for byte-by-byte transmission Typical Use Cases : Passing Form objects as is for processing Passing objects as URL Query parameters Storing objects data in text or in a single database field

5 PHP Object Serialization

6 Object Serialization

7 Magic Functions Reserved functions starting with double underscores Can be called during(in-between) the process of serialization/unserialization i.e. called automatically donot require invocation Ex : Prior to inserting an object in a database, construct can be called to make a connection and destruct to close it.

8 Unserialize Code Execution Code execution can be achieved when we pass a serialized object to the unserialised function(unserialize()), controlling the creation(serialization) of the object in memory.

9 Demo

10 Lab

11 Some Popular Bugs CVE : Magento Unauthenticated Remote Code Execution CVE :PEAR HTML_AJAX <= PHP Object Injection CVE : Tiki Wiki unserialize() PHP Code Execution CVE : Invision IP.Board unserialize() PHP Code Execution CVE : Horde Framework Unserialize PHP Code Execution CVE : Tuleap PHP Unserialize Code Execution CVE : Slim Framework PHP Object Injection CVE : vbulletin 5 Unserialize Code Execution CVE : Joomla RCE CVE : Moodle RCE

12 CVE : vbulletin 5.x Unserialize Code Execution

13 CVE : Joomla RCE

14 SQLi through Unserialize() - WooCommerce

15 References al%20php%20object%20injection.pdf

16 Java Serialization Binary XML

17 Java Binary Serialization Vulnerabilities readobject() of ObjectInputStream class Converts serialized java string to an object If user supplied input is passed other objects (Gadget Classes) can also be instantiated. readobject()

18 Gadget Chaining Process of getting to an object which can satisfy our need(greed) of exploitation The object or its definition in the form of a class must be present within the classpath

19 Gadget Chaining A Simple Example

20 Gadget Chaining The Slightly Complex One

$jar CommonsCollections1 'calc.exe' base64 tr -d "\n" https://github.$

21 ysoserial - Demo java -jar ysoserial-master- SNAPSHOT.jar CommonsCollections1 'calc.exe' base64 tr -d "\n"

22 Java XML Serialization Vulnerabilities XMLDecoder and Xstream to libraries in Java used for serializing objects using XML XSTREAM XMLDECODER

23 Java XML Serialization Vulnerabilities XML Decoder XMLDECODER

24 Java XML Serialization Vulnerabilities XStream Struts2 REST Plugin CVE XSTREAM

25 Lab

26 References and Vulnerable Softwares Everything you ever want to know about Java DeSerialization, period. Sheet

27 Bug Hunting? Python pickle.load() Ruby Marshal.load().NET Multiple Formatter objects Details Node.js unserialize() Java readobject() XMLDecoder XStream PHP unserialize() Search for the above functions in your code Specifically for PHP

28 Thank You

Deserialization vulnerability

Deserialization vulnerability By Abdelazim Mohammed(@intx0x80) Thanks to: Mazin Ahmed (@mazen160) Asim Jaweesh(@Jaw33sh) 1 P a g e Table of Contents Serialization (marshaling):... 4 Deserialization (unmarshaling):...