PHP serialization and deserialization syntax differences

The official documentation introduces PHP serialization and deserialization as follows:           (Recommended learning: PHP video tutorial)

所有php里面的值都可以使用函数serialize()来返回一个包含字节流的字符串来表示。unserialize()函数能够重新把字符串变回php原来的值。序列化一个对象将会保存对象的所有变量，但是不会保存对象的方法，只会保存类的名字。为了能够unserialize()一个对象，这个对象的类必须已经定义过。如果序列化类A的一个对象，将会返回一个跟类A相关，而且包含了对象所有变量值的字符串。

Simply put, serialization is the process of converting objects into strings, and deserialization is the process of restoring objects from strings.

Environment

The usage environment for the content described in the article is as follows:

PHP7.3.1、SDK
VSCode
C++和C

Recommended reference for environment configuration: " Using VSCODE to debug PHP7 source code under WINDOWS》

The public parameter deserialization execution process on the Internet is very detailed, but there are some deficiencies in some details, including serialization and deserialization. The syntax difference problem between By default, { and } are added to object conversions for concatenation into strings.

[var.c]
Line:882
static void php_var_serialize_intern()

Line:896
if (ce->serialize(struc, &serialized_data, &serialized_length, (zend_serialize_data *)var_hash) == SUCCESS) {
                        smart_str_appendl(buf, "C:", 2);
                        smart_str_append_unsigned(buf, ZSTR_LEN(Z_OBJCE_P(struc)->name));
                        smart_str_appendl(buf, ":\"", 2);
                        smart_str_append(buf, Z_OBJCE_P(struc)->name);
                        smart_str_appendl(buf, "\":", 2);

                        smart_str_append_unsigned(buf, serialized_length);
                        smart_str_appendl(buf, ":{", 2);
                        smart_str_appendl(buf, (char *) serialized_data, serialized_length);
                        smart_str_appendc(buf, '}');
                    }

Line:952
smart_str_appendl(buf, ":{", 2);

Line:995
smart_str_appendc(buf, '}');

Let’s take a look at the above code. PHP will use smart_str_appendl to splice the serialized string before and after: {and}, and enter the serialization logic starting from line 882 of var.c. Serialized string splicing is performed at line 896, and lines 952 and 995 are spliced ​​for inline methods.

Deserialization

Deserialization is to convert and restore the serialized string according to certain grammatical rules.

[var_unserialize.c]
Line:655
static int php_var_unserialize_internal()

Line:674
{
    YYCTYPE yych;
    static const unsigned char yybm[] = {
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
        128, 128, 128, 128, 128, 128, 128, 128, 
        128, 128,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
          0,   0,   0,   0,   0,   0,   0,   0, 
    };
    if ((YYLIMIT - YYCURSOR) < 7) YYFILL(7);
    yych = *YYCURSOR;
    switch (yych) {
    case &#39;C&#39;:
    case &#39;O&#39;:    goto yy4;
    case &#39;N&#39;:    goto yy5;
    case &#39;R&#39;:    goto yy6;
    case &#39;S&#39;:    goto yy7;
    case &#39;a&#39;:    goto yy8;
    case &#39;b&#39;:    goto yy9;
    case &#39;d&#39;:    goto yy10;
    case &#39;i&#39;:    goto yy11;
    case &#39;o&#39;:    goto yy12;
    case &#39;r&#39;:    goto yy13;
    case &#39;s&#39;:    goto yy14;
    case &#39;}&#39;:    goto yy15;
    default:    goto yy2;
    }

Line:776
yy15:
    ++YYCURSOR;
    {
    /* this is the case where we have less data than planned */
    php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
    return 0; /* not sure if it should be 0 or 1 here? */
}

Through the kernel code, you can see that line 655 enters deserialization. Deserialization uses lexical scanning to determine the corresponding objects of each symbol conversion. It can be seen that } is processed during deserialization. During the processing, the counter is only incremented by one and no other operations are performed.

Actual effect

The difference in deserialization syntax has a great impact on the security protection equipment's judgment of deserialization. In Snort, there is a rule as follows:

alert tcp any any -> any [80,8080,443] (uricontent:".php"; pcre:"/\{\w:.+?\}/"; sid:1; msg:php_serialize;)

Most characters can be used instead of {} in the attack payload, causing the rule to become invalid.

Summary

Differences in PHP serialization and deserialization syntax can be exploited in red team attacks to bypass protection.

In blue team defense, it is recommended to consider the method described in the definition that will not save the object, but only the name of the class. , intercept the name of the saved class, and the same characters in the syntax such as colon for defense.

The above is the detailed content of PHP serialization and deserialization syntax differences. For more information, please follow other related articles on the PHP Chinese website!