Resources
People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!
- It is very rare that an entirely new avenue of exploitation is found! This explains this new technique!
- PHP have URL style wrappers, such as zlib, php and so on. The issue relies on being used for exploitation is phar://.
- phar contains metadata in a serialized format.
- If a phar object is passed into the unserialized function, it can potentially be exploited by abusing class destructors, constructors or wakeups.
- The steps for exploitation:
- Craft a phar file onto the server. But, this can be done in a JPG too.
- This can be trigged within any file operation, including file_exists, filesize or other operations.
- Using the constructor, destructor or wakeup call, do some operation.
