Skip to content

Latest commit

 

History

History
18 lines (14 loc) · 661 Bytes

README.md

File metadata and controls

18 lines (14 loc) · 661 Bytes

PHP 8.0.20 unserialize backdoor

  • Type: hidden command
  • Affected versions: none (synthetic backdoor)

Backdoor

The backdoor is found in the "unserialize" part. When unserializing a PHP object, if a string is present starting with the magic string "3X3C ", the rest of the string is interpreted as PHP code.

Triggering the backdoor

We can use a carefully crafted serialized PHP object that executes arbitrary shell commands via the system() PHP function, through the backdoor (e.g., with the backdoored version):

$ ./backdoored/sapi/fuzz/php-fuzz-unserialize < backdoor-trigger.bin
uid=0(root) gid=0(root) groups=0(root)