$$ RED54 $$

• The VM needed for this challenge can be downloaded here.

Lab Objectives:

• Many CTFs on sites like https://ctftime.org include PHP deserialization challenges that work very much like what is running within this VM
• In this lab, you’ll uncover a string of the form Flag-SomeValue
• Full Disclosure: This challenge is based on the ‘CerealShop’ challenge from IronCTF 2024.

Lab Summary:

• Answer the question, ‘What is serialization?’ with example code.
• Identify the target VM using arp-scan as you don’t know the password and must access the webpage.
• Perform static code analysis on the target as the source code is provided for the challenge.
• Utilize Type Juggling to solve the first challenging situation within the code.
• Utilize an object reference to solve the second challenging situation within the code.
• Write a program to solve the challenge and reveal the flag.

What is Serialization?

• Object serialization in PHP is the process of converting an object into a storable or transmittable format, typically a string, so it can be saved in a file, sent over a network, or stored in a database. Later, the object can be reconstructed by deserializing it, restoring its state and properties. This is useful for maintaining object state across sessions or during communication between systems.

Write a program that serializes an object and prints back the object in serialized form.

• Create a file called example.php

pico example.php

Paste in the following code:

<?php
class SimpleObject {
    public $name = "John";
    public $age = 30;
}

$obj = new SimpleObject();
$serialized = serialize($obj);

echo $serialized;  
?>