m0leCon 2025 - Hiroki Matsukuma - Unawakened Wakeup: A New PHP Object Injection Technique for __w...

m0leCon 2025 Turin, Italy - 22/03/2025

PHP Object Injection is one of the critical vulnerabilities in web field as counted in OWASP Top Ten in 2017 and 2021. It allows an attacker to get shell access or read/write files by performing code reuse attack with carefully crafted objects (POP gadgets). Many researchers have developed powerful POP gadget chains however PHP package developers have also worked to reduce POP gadgets.
Some of web application frameworks and libraries have neutralized their POP gadgets by overriding __wakeup() to force an exception during deserialization. This kind of change is very simple for developers and works effectively as a mitigation. For example, Guzzle/RCE1 of PHPGGC, the POP gadget chain used for PoC exploit for CVE-2019-6340 of Drupal RCE, no longer works after guzzlehttp/guzzle 6.3.2 released in 2018.
In this talk, we will introduce a new technique that could bypass __wakeup() for PHP Object Injection with demonstration of the concept by reviving Guzzle/RCE1 to the present on Neos Flow framework. This talk will benefit penetration testers, exploit developer, and CTF players.

Видео m0leCon 2025 - Hiroki Matsukuma - Unawakened Wakeup: A New PHP Object Injection Technique for __w... канала pwnthem0le