Reviewing PHP Serialization Format

I noticed the user made an error in their PHP serialization. They wrote O:5 for "Access", but it should be O:6 since the string "Access" has 6 letters. The payload might be invalid because of that. The substring 'Access":' also exactly matches the serialized string, so blocking it makes sense, especially if "admin" is also involved.

Evaluating Payload Issue

The user proposed using null bytes in the protected property to hide the "admin" substring, but this doesn't work as expected. The value "admin" still appears as s:5:"admin" in the serialized string, so strpos will still catch it. Null bytes only hide the field name, not the value itself.

Exploring Serialization Strategy

Alright, I see the issue is that "admin" will still be blacklisted. Avoiding blacklisting "admin" is tricky since it needs to be in the username field. Using references or arrays might help, but serialized objects in PHP still show string values. Maybe "S" for PHP 8.2 could be a way to store the reference instead?

Understanding PHP Serialization

PHP uses 's' for strings, 'R' and 'r' for object/array references, but strings themselves can't be referenced using 'r' or 'R'. Instead, strings are handled separately in serialization. 'R' is for object references, and 'r' is for recursive references on arrays/objects. The 'S' key deals with serialized objects, not references.

Exploring Bypass Methods

To avoid the "Access": substring detection, I’m considering bypass strategies like using class name variations, which might break the substring detection if the class name isn't exactly "Access". However, even using subclass names might still hit the check and cause issues. Ultimately, changing serialized content poses challenges due to the strict checks.

Exploring Potential Bypasses

The tricky part is finding a way to avoid both the blacklist 'admin' and 'Access":'. I could manipulate the serialized string, using custom serialization tricks or relying on object injection, but the problem is that 'Access":' will likely always be present. Writing to stream wrappers like php://filter or using path traversal also seems difficult given the constraints on file paths and stream wrappers. I need to think through more alternatives.

Finding path traversal solutions

The main challenge is bypassing the 'lilctf' insertion in the include path. I could potentially craft a prefix and suffix that allow ‘lilctf’ to be treated as part of the file path and navigate around it, such as using '/var/www/html/lilctf/flag.php' instead of '/flag'. Crafting these boundaries carefully could allow to reach the target.

Bypassing serialization checks

The key problem is to bypass the string checks for 'admin' and 'Access":' without triggering the security check. I considered different approaches, like using incomplete classes or encoding tricks, but these options seem tricky given PHP's behavior with strings in serialization. I might need to rethink the method of bypassing these checks.

Exploring object deserialization tricks

The primary challenge is bypassing checks for 'admin' and 'Access":'. I considered tricks like exploiting references in serialization, using Destructors, or custom serialization for object manipulation. The idea of crafting a custom Serializable class that leads to 'Access' after multiple unserializations is a potential key, though tricky.

Bypassing checks with case manipulation

By changing the class name's case in serialized data (e.g., using 'aCcEsS' instead of 'Access'), we can bypass the case-sensitive 'Access":' blacklist check. The next challenge is ensuring the username gets set to 'admin', which triggers the destructor, while avoiding the 'Access":' restriction. I'll explore including code execution paths next.

Exploring path manipulation and serialization trickery

I'm considering various ways to bypass restrictions, like using the 'data://' wrapper with embedded PHP or relying on the "php://filter" to adjust paths. The main goal is to neutralize the 'lilctf' string by inserting it into comments. There's a good chance that the 'data://' trick will work reliably for this. I’m also thinking about how PHP handles protected properties when serialized, and how this could lead to unexpected behavior when they're accessed after deserialization.

Analyzing serialization and payload crafting

So, I’m diving into the calculation of the serialized string lengths to ensure everything is accurate when it comes to property names like "prefix" and "suffix". The naming conventions and special characters like \0 and * are throwing me off a bit, but I’m getting the calculation for "prefix" as 9 bytes total. Now I’m looking into how the PHP serialization handles protected properties—it's intriguing!

Double-checking serialized string construction

I've gone through the various parts of the serialized payload to ensure all calculations match up—like the correct lengths for "prefix" and "suffix" properties, as well as the impact of null byte characters in property names. I’m also considering two variants depending on configuration settings, including a fallback mechanism to deal with potential restrictions like allow_url_include.

Generating payload with guidance

To generate the correct payload, we need to calculate the lengths of serialized strings precisely and include null bytes in the property names. I provided a generator snippet in PHP for the user to run on their local machine. I also suggested using urlencode to properly encode the payload for submission and offered a fallback method if certain server features aren't enabled.

Thought for 4m 14s

outer2, url2 = build_payload('/var/www/html/flag.php') for i in range(0,len(url2),100): print(url2[i:i+100])

Thought for 4m 59s

Crafting the final string

It seems the output might be truncated due to display limitations from either the tool or the environment. To work around this, I could either print to a file and read it back or simply generate the full string manually. One option could be to use the python_user_visible tool, but for now, it's simpler to craft the string myself based on previous outputs and lengths. The URL-encoded string will be long, but I can handle that!

Generating the full output string

The tool prints output with "..." likely due to length limits. To bypass this, I'll use an alternative to fully display the payload URL string. Although saving to a file was an idea, showing the string directly in the message seems the simplest solution. I'll display both options for the flag paths concisely.

Thought for 1m 14s

Explaining the command and risks

Instead of giving a file for download, I'll provide a curl command to post and explain why the username is set to 0 for weak comparison. I'll also clarify the use of php://filter, base64 decoding, and avoiding black list checks through careful encoding. I'll add a note about 'pearcmd' and how 'allow_url_include' only affects particular wrappers.

Explaining PHP wrapper and approach

It sounds like we're discussing the php://filter wrapper in PHP and how it behaves beyond typical restrictions like allow_url_include. PHP's include function works with local wrappers, including php://filter, even when allow_url_include is off. We’ll recommend using fallback simple path normalization to bypass reliance on wrappers. The method involving setting username to 0 specifically exploits weak comparison.

Providing solution and file link

Got it! We can confirm that in PHP, 0 == "admin" evaluates as true due to type juggling. Now, for the suggested robust payload, let's provide detailed instructions along with the download link: Download the file. Don’t forget the citation: (website).

I'll craft the final response in Chinese, keeping it concise and friendly!

Providing instructions and download link

We can provide the sample command like this:

bash
curl -sS -X POST 'http://challenge.xinshi.fun:47282/' --data-urlencode 'user=<payload A>'

The actual string is in the payloads.txt file, and instead of making them download it, we can show the

Thought for 16s

Considering PHP behavior

PHP historically allowed null byte truncation in paths, creating vulnerabilities, but modern versions disallow it and treat nulls as invalid. The earlier path normalization approach is more reliable than using null bytes. As for user comparisons, the weak comparison of 0 to "admin" returns true due to loose matching rules.

Setting up challenge environment

To replicate the challenge, we should set up a Dockerfile and provide the corresponding index.php. The code needs to work with PHP 7.x or 8.x, and a test script will echo payloads for debugging. Additionally, a generator script is necessary to produce serialized strings with binary nulls in the property names, especially for protected fields. To bypass blacklisting, the payload should avoid containing "admin" and "Access":, using a class name like 'aCcEsS'.

Creating payload representation

To avoid mistakes, I should provide a PHP script that constructs the correct serialized string. While I could compute it in Python, it's easier to handle the property names with null bytes in PHP. The properties might look like "\0*\0prefix" and "\0*\0suffix". I'll ensure correct length calculations and provide a finished payload string.

Counting resource path length

Okay, I’ve got the resource path length mostly nailed — 'php://filter/convert.base64-encode/resource=/' adds up to 44 characters. I’ll avoid counting manually in the script, though; it’ll calculate it automatically instead. We’ll also provide a Dockerfile for the local setup and make sure errors are displayed during testing.

Creating local environment and payload generator

We’ll set up a simple local environment with a PHP server or Docker. For testing, I’ll provide a make_payload.php to generate the necessary payload, and send.sh to send it via curl. We'll also provide a README.md and other files like the main index.php. I'll ensure everything works smoothly without modifying the challenge itself.

Thought for 47s