Insecure Deserialization: Turning Untrusted Data Into Objects (and Gadgets)

What it is#

Deserializing attacker-controlled data means reconstructing whatever objects that data claims to describe, magic methods included. If the right class happens to be available, its constructor or destructor runs with the fields you chose.

The labs here#

• MemoryLane preferences cookie gadget: a cookie is passed straight to PHP's unserialize(), with no restriction on which classes it can build. A ThemeCache class's destructor writes a file to disk using fields you control, which is enough to drop a web shell.
• ClubTrack bulk-import gadget chain: a longer chain this time. A MemberSession object's destructor calls ->flush() on whatever object you set as its logger. Point that logger field at an ActivityLogger instead, and flush() writes attacker-controlled content to a file of your choosing.