среда, 9 декабря 2015 г.

One more useful PHP class for unserialize() bugs

In a hurry to share PHP common class for deserialization vulnerabilities.
It's FileCookieJar class of Guzzle project.

Look at its destructor https://github.com/guzzle/guzzle/blob/master/src/Cookie/FileCookieJar.php#L37-L61:
<?
    public function __destruct()
    {
        $this->save($this->filename);
    }
    /**
     * Saves the cookies to a file.
     *
     * @param string $filename File to save
     * @throws \RuntimeException if the file cannot be found or created
     */
    public function save($filename)
    {
        $json = [];
        foreach ($this as $cookie) {
            /** @var SetCookie $cookie */
            if (CookieJar::shouldPersist($cookie, $this->storeSessionCookies)) {
                $json[] = $cookie->toArray();
            }
        }
        if (false === file_put_contents($filename, json_encode($json))) {
            throw new \RuntimeException("Unable to save file {$filename}");
        }
    }
?>
Who can construct valid exploit without hints? ;)
It's easy.

40 комментариев:

  1. Thanks for sharing, nice post!

    Chia sẻ các mẹ bí quyết cách nấu cháo khoai lang cho bé cho bé ăn dặm hay nấu trứng món ăn dặm cho bé với bài nấu cháo trứng gà với rau gì hay bột yến mạch có vai trò giúp bé khỏe mạnh với bài cách nấu cháo yến mạch cho bé hay cua biển nấu cháo như thế nào cháo cua biển nấu với rau gì hay cá chép rất bổ cho bé thì nấu như thế nào với bài cách nấu cháo cá chép cho bé con trai cũng rất bổ dưỡng cho bé mẹ tham khảo cách nấu cháo trai cho bé hay cách nấu cháo trứng cho bé ăn dặm với bài nấu cháo trứng gà với rau gì hay cháo tim heo nấu như thế nào với bài nấu cháo tim lợn với rau gì hay trẻ sơ sinh ngủ như thế nào với bài trẻ sơ sinh ngủ ít có ảnh hưởng gì đến sức khỏe của trẻ hay không.

    ОтветитьУдалить
  2. What you will utilize the cash for or why you require it so desperately are not questions which apply to a vehicle title bank.
    Payday Loans San-diego
    Cash Advance
    Auto Title Loans

    ОтветитьУдалить
  3. The article you have shared here very good.Tally kya hai This is really interesting information for me. Thanks for sharing!

    ОтветитьУдалить
  4. Read the information you share, it is very helpful for me.
    Những dịch vụ mà Chuyenhangvevietnam.com đang cung cấp tới quý khách hàng.
    - cho thuê xe tải 500kg tự lái giá rẻ
    - vận chuyển hàng hóa bắc nam bằng container
    - dịch vụ vận chuyển ô tô bắc nam giá rẻ
    - cho thuê xe tải tự lái theo tháng
    - Chuyển phát nhanh
    - Giao hàng nhanh
    - Giao hàng tận nơi
    - Cho thuê kho
    - Ship cod

    Liên hệ với chúng tôi qua số hotline 1900 1247 để được tư vấn và sử dụng dịch vụ.

    ОтветитьУдалить
  5. با توجه به اینکه شرکت نکست هر ساله آلبوم های جدید آلبوم کاغذ دیواری را به مجموعه خود اضافه می کند کاغذ دیواری هایی که مربوط به سال های گذشته کاغذ دیواری ایتالیایی هستند از جوری در می آیند و همین موضوع باعث می شود که روی این کاغذ دیواری ها

    تنها هتل جزیره هرمز با قیمت مناسب و امکانات خوب. هر سوییت شامل آشپزخانه و هرمز سرویس بهداشتی جداگانه. رخت خواب ها و حوله ها خیلی تمیز . غذای رستوران دریایی به سبک محلی و خیلی خوشمزه با قیمت مناسب.

    ОтветитьУдалить
  6. เกมยิงปลาที่ใครๆก็เล่นกัน ได้เงินจริงแน่นอน https://www.slot1234.com/เกมยิงปลาออนไลน์

    ОтветитьУдалить
  7. Hey,

    Thenkx For Sharing this article for us. this is really cool.
    Thenkx again

    Regards
    ChaluBaba

    ОтветитьУдалить
  8. Khatron Ke Khiladi is all set to come up with the new season very soon.
    based television reality show has completed their 9th season successfully.

    Yeh Rishta Kya Kehlata Hai

    ОтветитьУдалить
  9. Nazar is a Hindi language Indian Television serial on
    Star Plus of 2018. This tv serial features Hotstar Cast and Crew

    Ishq Mein Marjawan 2 Watch Online

    ОтветитьУдалить
  10. If you’re keen on watching a film or need to watch Hindi, Tamil, Telugu, Malayalam Movies. So hubflixhd web site is excellent for you. As a result of there may be multiple assortment out there on this web site. We are going to attempt to learn about all these intimately beneath.

    ОтветитьУдалить
  11. Movie flix 2020 - Download Bollywood, Hollywood, Panjabi, Tamil Movies, Leaked by movie flix website. Movies flix 2020 Everyone likes to watch...
    movies flix 2020
    Bollywood News
    fatteshikast Marathi Movie VipMarathi
    daily shayaris
    all song lyrics
    all tech news

    ОтветитьУдалить
  12. E-commerce research paper writers are hard to come across them for those in need of E-commerce Essay Writing Services and trade and e-commerce writing services.

    ОтветитьУдалить
  13. Yomovies is the one of the top rated site that offers online free movies, video content that viewers can watch on this webpage. From being most

    Movierulz

    ОтветитьУдалить
  14. Bigg Boss 14 Season Is going to on air from november 2020. the contestant
    list will be released soon. This time host is also salman khan.

    Bigg Boss 14 Live

    ОтветитьУдалить
  15. All the latest episodes of Bigg Boss 13 are available for watch on the JioCinema app.
    You can select ... How can I apply online for Bigg Boss 14 season 2020?


    Bigg Boss 14 Online

    ОтветитьУдалить

  16. Yeh Rishta Kya Kehlata Hai Chapter 60. Kartik and Naira announce to the ...
    Will Manish and Dadi accept it? Watch the full episode, online only on Hotstar.

    Yeh Rishta Kya Kehlata Hai Watch Online

    ОтветитьУдалить
  17. Bigg Boss 14 is Colors tv show, To watch bigg boss season 14
    You can get the episodes all at voot official website

    Watch Bigg Boss 14 Online

    ОтветитьУдалить
  18. Bigg Boss – Auditions & Online Registration Season 14, 2020. Bigg Boss is an
    Indian reality television game that is broadcasted in colors TV

    Bigg Boss 14 Online

    ОтветитьУдалить

  19. KissAsian Is Asian Drama Backstreet Rookie comes to an end this weekend.
    Before fans watch the curtain close on the series, Ji Chang Wook and Kim.

    KissAsian

    ОтветитьУдалить
  20. Bigg Boss is a television reality show broadcast on Colors channel in India.
    Later on Day 14, one of Day 1 evicted housemate enter the house as a Wild-Card.

    Bigg Boss 14
    ======================================

    ОтветитьУдалить
  21. Tonton Dramas is a intresting dramas serial by malalysian chanel Tonton, Tv3, Astro Ria,
    Astro Prima and Astro Citra.Tonton Dramas watch online all episodes and download free HD quality videos.

    Astro Ria Live

    ОтветитьУдалить
  22. Bigg Boss 14 Online Application Form · Now, you have to search for the
    auditions and then click on apply now.An application form will appear.

    Watch Bigg Boss 14 All Episodes

    ОтветитьУдалить
  23. Bigg Boss 14 Full Show All Episde in HD Today Latest Episode New,
    Watch Indian Most Famous Reality Show In HD Bigg Boss 14 New Season 2020,
    Host Salman Khan Bigg Boss House Ful HD by Colors Tv

    Bigg Boss 14
    Bigg Boss 14 Watch All Episodes Online HD
    Thanks for sharing such a nice stuff

    ОтветитьУдалить
  24. Bigg Boss 14 Full Show All Episde in HD Today Latest Episode New,
    Watch Indian Most Famous Reality Show In HD Bigg Boss 14 New Season 2020,
    Host Salman Khan Bigg Boss House Ful HD by Colors Tv

    Bigg Boss 14
    Bigg Boss 14 Watch All Episodes Online HD
    Thanks for sharing such a nice stuff
    biggboss14watchlive.com

    ОтветитьУдалить
  25. Bigg Boss 14 Full Show All Episde in HD Today Latest Episode New,
    Watch Indian Most Famous Reality Show In HD Bigg Boss 14 New Season 2020,
    Host Salman Khan Bigg Boss House Ful HD by Colors Tv

    Bigg Boss 14
    Bigg Boss 14 Watch All Episodes Online HD
    Thanks for sharing such a nice stuff

    ОтветитьУдалить

  26. Welcome to DesiSerials. We exhibit desi serial channels online.
    Desi TV Serial that are loved by Hindi people Watch them here.

    Bigg Boss 14 Watch Online

    ОтветитьУдалить
  27. Reliable religion & theology coursework writing services are not hard to come across for those in need of Religious Research Writing Services and theology & religion essay writing services.

    ОтветитьУдалить
  28. Bigg Boss 14 Full Show All Episde in HD Today Latest Episode New,
    Watch Indian Most Famous Reality Show In HD Bigg Boss 14 New Season 2020 2021,
    Host Salman Khan Bigg Boss House Ful HD by Colors Tv

    Bigg Boss 14
    Bigg Boss 14 Watch All Episodes Online HD
    Thanks for sharing such a nice stuff

    ОтветитьУдалить
  29. Bigg Boss 14 Full Show All Episde in HD Today Latest Episode New,
    Watch Indian Most Famous Reality Show In HD Bigg Boss 14 New Season 2020 2021,
    Host Salman Khan Bigg Boss House Ful HD by Colors Tv

    Bigg Boss 14
    Bigg Boss 14 Watch All Episodes Online HD
    Thanks for sharing such a nice stuff

    ОтветитьУдалить

  30. Watch star plus Hindi general entertainment tv live stream channel .
    star plus was first launched #StarPlus #India #TV #Channel free online

    Star Plus Live Tv

    ОтветитьУдалить
  31. Movierulz Telugu is a movies piracy site, it allows to download
    Hollywood, Tamil, Telugu Movies. Movierulz Telugu gives you the

    Movierulz 2021

    ОтветитьУдалить

  32. Find Lottery Sambad Result Latest News, Videos & Pictures on
    Lottery Sambad Result and see latest updates, news, information

    Lottery Sambad Live Result

    ОтветитьУдалить

  33. Trapped between the past and the present, will he find love beyond the chains
    of duty? Watch Ghum Hai Kisikey Pyaar Meiin - Hindi Romance serial on Disney+


    Ghum Hai Kisi Ke Pyar Mein

    ОтветитьУдалить
  34. Watch Kundali Bhagya (2017), Hindi Show. It is a Drama Show, starring
    Shraddha Arya and Anjum Fakih. The show narrates the story of two

    Kundali Bhagya Watch Online

    ОтветитьУдалить
  35. Anupamaa sacrificed a lot to become a loyal wife, a devoted
    only to be disrespected in return. After the bitter realization

    Anupama Desi Serial

    ОтветитьУдалить