当前位置：网站首页>[security attack and Defense] how much do you know about serialization and deserialization?
[security attack and Defense] how much do you know about serialization and deserialization?
2022-07-04 04:30:00 【InfoQ】
1. Serialization and deserialization
First, we need to understand the definition of serialization and deserialization , And the basic functions used in serialization and deserialization .
serialize ： The process of converting an object into a sequence of bytes is called object serialization , Equivalent to archiving in the game .
PHP Serialization function in
serialize()**serialize()** Function for serialization
object or
Array , And return a string .
serialize()
Function serializes the object , It can be easily passed to other places that need it , And its
The type and structure will not change
.
Example ：
<?php
highlight_file(__FILE__);
$sites=array('I', 'Like', 'PHP');
echo'<br/>';
var_dump(serialize($sites)); // Serialize this object
echo'<br/>';
classman{
public$name="xiaocui";
public$sex="man";
private$age=26;
}
$M=newman();// Create an object
var_dump(serialize($M)); // Serialize this object
?>
The output is ：
string(47) "a:3:{i:0;s:1:"I";i:1;s:4:"Like";i:2;s:3:"PHP";}"
string(79) "O:3:"man":3:{s:4:"name";s:7:"xiaocui";s:3:"sex";s:3:"man";s:8:"manage";i:26;}"
Parameter description ：
Serialization of arrays ：
a Represents an array
3 There are... In the representative array 3 Elements
i Subscripts representing arrays
0 representative I Subscript value of element
s Representative elements I The data type of is character type
1 Representative elements I The length of is 1
object serialization ：
O Representation is an object
3 Represents the class name man The length of
3 Represents the number of fields in the class
s Representative attribute name The type of is character type
4 Representative attribute name The length of
// And so on , Serialize the field contents in the string with { Start ,;} end
Deserialization ： The process of restoring a byte sequence to an object is called deserialization of the object , Equivalent to reading files in the game .
【 Help safe learning , All resources are obtained from one by one 】
① Network Security Learning Route
②20 Penetration test ebook
③ Safe attack and defense 357 Page notes
④50 A security attack and defense interview guide
⑤ Safety red team penetration Kit
⑥ information gathering 80 Search syntax
⑦100 Three actual cases of vulnerability
⑧ Internal video resources of the safety factory
⑨ Calendar year CTF Analysis of the flag race
PHP Deserialization function in
unserialize()**unserialize()** Function is used to restore the serialized string to
The original array or object The process of .**unserialize()** Function can quickly restore the serialized string , Used to complete its original function .
Sample code ：
<?php
highlight_file(__FILE__);
$sites=array('I', 'Like', 'PHP');
echo'<br/>';
echo$ser=serialize($sites).'<br/>'; // Serialize this object
var_dump(unserialize($ser)); // Deserialize the serialized string
echo'<br/>';
classman{
public$name="xiaocui";
public$sex="man";
private$age=26;
}
$M=newman();// Create an object
echo$ser=serialize($M).'<br/>'; // Serialize this object
var_dump(unserialize($ser)); // Deserialize the serialized string
?>
The output is ：
a:3:{i:0;s:1:"I";i:1;s:4:"Like";i:2;s:3:"PHP";}
array(3) { [0]=>string(1) "I"[1]=>string(4) "Like"[2]=>string(3) "PHP"}
O:3:"man":3:{s:4:"name";s:7:"xiaocui";s:3:"sex";s:3:"man";s:8:"manage";i:26;}
object(man)#2 (3) { ["name"]=> string(7) "xiaocui" ["sex"]=> string(3) "man" ["age":"man":private]=> int(26) }
You can see the array or object deserialized above , There is no change with the original data .
The role of serialization and deserialization in the system
① Put the byte sequence of the object permanently on disk , It can be called at any time when necessary , Greatly save disk space .
② Byte sequence can be directly transmitted during transmission , Not the object , This can greatly improve the transmission rate .
In the business system , Some objects need to be serialized and stored , Get them out of memory space , In a file , For persistent storage . for example ： When the user registers and logs into the system , User information such as user name , password ,cookie Wait for information to be stored through serialization , When the user logs in again, the serialized byte sequence is deserialized into the original object and used in memory , It can greatly save memory overhead .
2. Magic methods
PHP Put all in
__（ Two underscores ） Class methods at the beginning remain magic methods . So when defining a class method , In addition to the above magic methods , It is not recommended that
__ The prefix .
PHP Common magic methods in
__construct()
have
__construct
The class of the function will call this method first every time a new object is created , It's suitable to do some initialization work before using objects .
Code example ：
<?php
highlight_file(__FILE__);
classdemo{
public$name="xiaocui";
public$sex="man";
private$age=26;
publicfunction__construct()
{
echo"<br/>"." Call me when the class is instantiated ！";
}
}
$D=newdemo(); // Instantiate objects
?>
Output results ：
Call me when the class is instantiated ！
__destruct()
This function will be executed when all references to an object are deleted or when the object is destroyed
Code example ：
<?php
highlight_file(__FILE__);
class demo{
public $name="xiaocui";
public $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function num($a,$b){
echo $c = $a + $b.'<br/>';
return $c;
}
public function __destruct(){
echo " Call me when all the methods in the class are destroyed ！";
}
public function person($per){
echo "We are $per !!!".'<br/>';
}
}
$D=new demo(); // Instantiate objects
$D->num(5,6); // call num() Method
$D->person(man); // call person() Method
?>
Output results ：
Call me when the class is instantiated ！
11
Weareman!!!
Call me when all the methods in the class are destroyed ！
The above output results can directly see the execution order of the code ：
__construct()=>
num(5,6)=>
person(nanren)=>
__destruct() When instantiating an object, first execute the construction method
__construct(), Then, execute the instance in the class
num()、
person(), When all methods are executed and destroyed , Finally, call the destructor method
__destruct().
__wakeup()
In the use of
unserialize() when , Will check if there is one
__wakeup() Magic methods . If there is , Then the method will be called first , Prepare resources needed for objects in advance .
Code example ：
<?php
highlight_file(__FILE__);
classdemo{
public$name="xiaocui";
protected$sex="man";
private$age=26;
publicfunction__construct()
{
echo"<br/>"." Call me when the class is instantiated ！"."<br/>";
}
publicfunction__destruct(){
echo"<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
publicfunction__wakeup()
{
echo"<br/>"." When the sequence is reversed, first call me ！".'<br/>';
}
}
$D=newdemo(); // Instantiate objects
echo$ser=serialize($D); // Serializing objects $D
var_dump(unserialize($ser)); // Deserialize string $ser
?>
Output results ：
because
$age For private property , White space characters will be added before and after serialization %00, The original character length is 7, If you add white space characters on both sides, the character length will become 9
Call me when the class is instantiated ！
O:4:"demo":3:{s:4:"name";s:7:"xiaocui";s:6:"*sex";s:3:"man";s:9:"demoage";i:26;}
Call me when the sequence is reversed ！
object(demo)#2
(3) { ["name"]=> string(7) "xiaocui" ["sex":protected]=>
string(3) "man" ["age":"demo":private]=> int(26) }
Call me when all the methods in the class are destroyed ！
Call me when all the methods in the class are destroyed ！
The above output results can directly see the execution order of the code ：
__construct()=>
serialize($D)=>
__wakeup()=>
unserialize($ser)=>
__destruct()=>
__destruct() When instantiating an object, first execute the construction method
__construct(), Then the serialization is performed
serialize($D), Then, before deserialization, execute
__wakeup() Method , Then perform deserialization
unserialize($ser), When all methods are executed and destroyed, execute finally
__destruct() destructor , After deserialization, the original serialized string is restored and executed again
__destruct().
__toString()
__toString() Method is used to define how a class is treated as a string .
Sample code ：
<?php
highlight_file(__FILE__);
class demo{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function __wakeup()
{
echo "<br/>"." Call me when the sequence is reversed ！".'<br/>';
}
public function __toString(){
return "<br/>"." Class is called when it is treated as a string ！"."<br/>";
}
}
$D=new demo(); // Instantiate objects
echo $D; // Class is output as a string
?>
Output results ：
Call me when the class is instantiated ！
Class is called when it is treated as a string ！
Call me when all the methods in the class are destroyed ！
The above output results can be seen , When a class is treated as a string
echo when ,
__toString() Method is called and executed .
If there is no... In this class
__toString() Method , Conduct echo When the output ,PHP Will throw fatal errors , Error is as follows ：
Catchablefatalerror: ObjectofclassdemocouldnotbeconvertedtostringinD:\XXXX\phpstudy_pro\WWW\two\demo.phponline30
__sleep()
In the use of
serialize() Function time , The program will check whether there is a
__sleep() Magic methods . If there is , Then the method will be called first , And then perform the serialization operation .
__sleep() Methods are often used to submit uncommitted data , Or similar cleaning operations . meanwhile , If there are some big objects , But it doesn't need to be all saved , This function has a good cleaning effect .
Sample code ：
<?php
highlight_file(__FILE__);
class demo{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function __wakeup()
{
echo "<br/>"." Call me when the sequence is reversed ！".'<br/>';
}
public function __sleep(){
echo "<br/>"." Call me when the sequence ！".'<br/>';
return array("name","sex","age"); // Here you have to return a number , The element inside represents the name of the returned attribute
}
}
$D=new demo(); // Instantiate objects
echo $ser = serialize($D); // Serializing objects
?>
Output results ：
Call me when the class is instantiated ！
Call me when the sequence ！
O:4:"demo":3:{s:4:"name";s:7:"xiaocui";s:6:"*sex";s:3:"man";s:9:"demoage";i:26;}
Call me when all the methods in the class are destroyed ！
The above output results can be seen , When the class is serialized, it first calls
__sleep() Method , This function must return a value . If the function does not return properties , When serializing, the attribute will be cleared .
__invoke()
When trying to call an object as a function ,
__invoke Method will be called automatically .(
This feature only exists in PHP 5.3.0 And above are valid
.)
Code example ：
<?php
highlight_file(__FILE__);
class demo{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function __wakeup()
{
echo "<br/>"." Call me when deserializing ！".'<br/>';
}
public function __sleep(){
echo "<br/>"." Call me when serializing ！".'<br/>';
return array("name","sex","age");
}
public function __invoke()
{
echo "<br/>"." When you call an object in a functional way, you will call me ！".'<br/>';
}
}
$D=new demo(); // Instantiate objects
$D(); // Call the object as a function
?>
Results output ：
Call me when the class is instantiated ！
When you call an object in a functional way, you will call me ！
Call me when all the methods in the class are destroyed ！
The above results can be seen when using the method of a function to call an object , Will call
__invoke() Method .
If there is no such method in the class , that PHP Fatal errors will be reported , as follows ：
Fatalerror:
UncaughtError:
FunctionnamemustbeastringinD:\xxxxx\phpstudy_pro\WWW\two\demo.php:42Stacktrace:
#0 {main} thrown in D:\xxxxx\phpstudy_pro\WWW\two\demo.php on line 42
__call()
When calling a nonexistent or inaccessible method in an object ,
__call Will be called .
Code example ：
<?php
highlight_file(__FILE__);
class demo{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function num($a,$b){
echo "<br/>".$c = $a + $b.'<br/>';
return $c;
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function person($per){
echo "<br/>"."We are $per !!!".'<br/>';
}
public function __wakeup()
{
echo "<br/>"." Call me when deserializing ！".'<br/>';
}
public function __sleep(){
echo "<br/>"." Call me when the sequence ！".'<br/>';
return array("name","sex","age");
}
public function __call($arg1,$arg2){
echo "<br/>"." Call me when an object calls a method that does not exist or is inaccessible ！".'<br/>';
}
}
$D=new demo(); // Instantiate objects
$D->num1(1,2); // Call a method that doesn't exist
?>
Results output ：
Call me when the class is instantiated ！
Call me when an object calls a method that does not exist or is inaccessible ！
Call me when all the methods in the class are destroyed ！
__set()
When assigning a value to an inaccessible property ,
__set Will be called .
Code example ：
<?php
highlight_file(__FILE__);
class demo extends demo1{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function person($per){
echo "<br/>"."We are $per !!!".'<br/>';
}
public function __set($arg1,$arg2){
echo "<br/>"." Call me when assigning a value to a nonexistent or inaccessible property ！"."<br/>";
}
}
class demo1{
private $weight;
public $height;
public function people(){
echo $this->weight;
echo $this->height;
}
}
$D=new demo(); // Instantiate objects
$D->weight=74; // Assign values to inaccessible properties
?>
Output results ：
Call me when the class is instantiated ！
Call me when assigning a value to a nonexistent or inaccessible property ！
Call me when all the methods in the class are destroyed ！
__isset()
Call on inaccessible properties
isset() or
empty() when ,
__iset() Will be called .
__unset()
Call on inaccessible properties
unset() when ,
__unset() Will be called .
__get()
When reading the value of an inaccessible property ,
__get Will be called .
Code example ：
<?php
highlight_file(__FILE__);
class demo extends demo1{
public $name="xiaocui";
protected $sex="man";
private $age=26;
public function __construct()
{
echo "<br/>"." Call me when the class is instantiated ！"."<br/>";
}
public function __destruct(){
echo "<br/>"." Call me when all the methods in the class are destroyed ！"."<br/>";
}
public function __get($arg1){
echo "<br/>"." Call me when reading non-existent or inaccessible properties ！";
}
}
class demo1{
private $weight = 0;
public $height;
public function people(){
echo $this->weight;
echo $this->height;
}
}
$D=new demo(); // Instantiate objects
$D->weight; // Read inaccessible properties in the parent class
?>
Output results ：
Call me when the class is instantiated ！
Call me when reading non-existent or inaccessible properties ！
Call me when all the methods in the class are destroyed ！
3. Deserialization vulnerability
3.1 Deserialization exploit condition
① unserialize() The parameters in the function are controllable
② There are classes available , And there are magic methods in the class
Code example 1：
<?php
highlight_file(__FILE__);
class demo
{
public $arg1 = "0";
public function __destruct()
{
echo $this->arg1; // Output user passed arg1 value
}
}
$a=$_GET['arg']; // Receive the... Transmitted by the front end arg1 Variable
$unser = unserialize($a); // Deserialize passed arg1
?>
The above code meets two conditions of deserialization vulnerability ,
arg Parameter controllable , That is to say
unserialize() The parameters of the function are controllable ; There are classes available
demo, And demo There are magic methods available in class
__destruct(), However
__destruct() Magic method used echo Output variables
arg.
adopt
arg Parameters , Construct serialization string , adopt
unserialize() Function , Finally through
__destruct() Magic method output variable , cause
XSS.
Sample code 2
<?php
highlight_file(__FILE__);
class demo
{
public $arg1 = "0";
public function __destruct()
{
eval($this->arg1); //eval() To execute the user passed arg1 value
}
}
$a=$_GET['arg']; // Receive the... Transmitted by the front end arg1 Variable
$unser = unserialize($a); // Deserialize passed arg1
var_dump($unser);
?>
If magic methods exist
eval(), And the parameters are controllable , Then by constructing a serialized string , Through deserialization vulnerability
RCE.
3.2 __wakeup() Function bypasses
When the attributes of the passed object are larger than those of the actual object during serialization ,
__wakeup() Magic methods will not be performed , This leads to bypassing .
PHP edition <=5.6.25 perhaps PHP edition <=7.0.11
Sample code ：
<?php
highlight_file(__FILE__);
class demo
{
public $arg1 = "0";
public function __destruct()
{
eval($this->arg1); //eval() To execute the user passed arg1 value
}
public function __wakeup(){
foreach(get_object_vars($this) as $k => $v) {
$this->$k = ''; // Traverse the passed parameters , All assignments are empty
}
}
}
$a=$_GET['arg']; // Receive the... Transmitted by the front end arg1 Variable
$unser = unserialize($a); // Deserialize passed arg1
var_dump($unser);
?>
If the attribute value is the same as the actual attribute value of the object , Will be executed during deserialization
__wakeup() Function replaces the passed in variable value with null .
If the property value is set to be greater than the actual object property value, it will bypass
__wakeup() function .
边栏推荐
猜你喜欢
什么是上下文？
微信公众号无限回调授权系统源码
Leetcode skimming: binary tree 08 (maximum depth of n-ary tree)
十字路口通行优先权，十字路口通行规则图解
NFT new opportunity, multimedia NFT aggregation platform okaleido will be launched soon
2021 RSC | Drug–target affinity prediction using graph neural network and contact maps
Graduation project
浅谈JVM的那些事
疫情远程办公经验分享| 社区征文
UnicodeDecodeError: ‘gbk‘ codec can‘t decode byte 0x98 in position 1093: illegal multibyte sequence
随机推荐
微信脑力比拼答题小程序_支持流量主带最新题库文件
C语言单向链表练习
NFT新的契机，多媒体NFT聚合平台OKALEIDO即将上线
架构实战营 - 第 6 期 模块九之毕业设计
微信公众号无限回调授权系统源码
【云原生】那些看起来很牛X，原理却很简单的一行代码
MySQL JDBC编程
[csrf-01] basic principle and attack and defense of Cross Site Request Forgery vulnerability
戳气球和布尔运算问题（巨难）
MIN_RTO 对话
2020 Bioinformatics | TransformerCPI
(pointeur) Écrivez - vous une fonction qui compare la taille de la chaîne et fonctionne comme strcmp.
仿《游戏鸟》源码 手游发号评测开服开测合集专区游戏下载网站模板
NFT new opportunity, multimedia NFT aggregation platform okaleido will be launched soon
How to add custom API objects in kubernetes (1)
浅谈一篇优质的小红书文案需要具备什么
【微服务｜openfeign】feign的两种降级方式｜Fallback｜FallbackFactory
Parameterization of controls in katalon
Katalon uses script to query list size
Leetcode skimming: binary tree 04 (sequence traversal of binary tree)