Phar Deserialization

PHAR Deserialization Exploitation

Overview

PHAR (PHP Archive) files contain metadata in serialized format. When parsed, this metadata is deserialized, which can be abused to exploit deserialization vulnerabilities in PHP code. The key advantage is that deserialization occurs even when using PHP functions that don't execute PHP code, such as:

• file_get_contents()
• fopen()
• file()
• file_exists()
• md5_file()
• filemtime()
• filesize()

When to Use This Technique

Use PHAR deserialization exploitation when:

1. You can control a file path parameter in a PHP application
2. The application uses phar:// protocol to read files
3. You find PHP classes with magic methods like __destruct(), __wakeup(), or __toString()
4. The application performs file operations on user-controlled paths
5. You need to bypass file upload restrictions (PHAR files can include magic bytes like JPG headers)

Exploitation Workflow

Step 1: Identify the Vulnerable Class

Look for PHP classes with magic methods that execute code during deserialization:

class AnyClass {
    public $data = null;
    public function __construct($data) {
        $this->data = $data;
    }

    function __destruct() {
        system($this->data);  // This executes during deserialization
    }
}

Step 2: Create the Malicious PHAR File

Use the bundled script scripts/create_phar.php to generate a malicious PHAR file. This script:

1. Creates a new PHAR archive
2. Adds a dummy file to the archive
3. Sets a custom stub with magic bytes (to bypass file upload filters)
4. Embeds a serialized object as metadata
5. Buffers and saves the PHAR file

Step 3: Trigger the Deserialization

When the vulnerable PHP code processes your PHAR file via phar:// protocol, the deserialization will trigger the magic method, executing your payload.

Example Exploitation

Vulnerable Application Code

<?php
class AnyClass {
    public $data = null;
    public function __construct($data) {
        $this->data = $data;
    }

    function __destruct() {
        system($this->data);
    }
}

filesize("phar://test.phar"); // Attacker controls this path

Creating the Exploit

1. Create the PHAR file using the bundled script:

   php --define phar.readonly=0 scripts/create_phar.php
   

2. Upload or place the PHAR file where the vulnerable application can access it

3. Trigger the vulnerability by accessing the vulnerable endpoint with the PHAR file path

Bypassing File Upload Restrictions

The PHAR file can include magic bytes at the beginning to bypass file type restrictions. For example, adding JPG magic bytes (\xff\xd8\xff) makes the file appear as a valid image while still being a valid PHAR archive.

Common Magic Methods to Exploit

• __destruct() - Called when object is destroyed
• __wakeup() - Called after unserialization
• __toString() - Called when object is converted to string
• __invoke() - Called when object is called as a function
• __call() - Called when invoking inaccessible methods

Testing Checklist

• Can you control a file path parameter?
• Does the application use phar:// protocol?
• Are there classes with magic methods in the codebase?
• Can you upload or place files on the server?
• Is phar.readonly set to 0 (required to create PHAR files)?

References

• New PHP Exploitation Technique - Ripstech
• PHP Manual - PHAR
• PHP Manual - Serialization