$$
RED54
$$
- The VM needed for this challenge can be downloaded here.
Lab Objectives:
- Many CTFs on sites like https://ctftime.org include PHP deserialization challenges that work very much like what is running within this VM
- In this lab, you’ll uncover a string of the form Flag-SomeValue
- Full Disclosure: This challenge is based on the ‘CerealShop’ challenge from IronCTF 2024.
Lab Summary:
- Answer the question, ‘What is serialization?’ with example code.
- Identify the target VM using
arp-scan as you don’t know the password and must access the webpage.
- Perform static code analysis on the target as the source code is provided for the challenge.
- Utilize Type Juggling to solve the first challenging situation within the code.
- Utilize an object reference to solve the second challenging situation within the code.
- Write a program to solve the challenge and reveal the flag.
What is Serialization?
- Object serialization in PHP is the process of converting an object into a storable or transmittable format, typically a string, so it can be saved in a file, sent over a network, or stored in a database. Later, the object can be reconstructed by deserializing it, restoring its state and properties. This is useful for maintaining object state across sessions or during communication between systems.
Write a program that serializes an object and prints back the object in serialized form.
- Create a file called
example.php
pico example.php
Paste in the following code:
<?php
class SimpleObject {
public $name = "John";
public $age = 30;
}
$obj = new SimpleObject();
$serialized = serialize($obj);
echo $serialized;
?>