Skip to content

Latest commit

 

History

History
90 lines (61 loc) · 2.59 KB

introduction-to-deserialization-attacks.md

File metadata and controls

90 lines (61 loc) · 2.59 KB

Introduction to Deserialization Attacks

Introduction

If an application ever deserializes user-controlled data, there is a possibility for a deserialization attack to occur. An attack involves:

  • Modifying serialized data generated by the application
  • Generating and supplying custom serialized data

History

  • 2011 - Deserialization known as attack vector
  • 2015 - Security researchers @frohoff and @gebl released ysoserial (Java deserialization payloads)
  • 2016 - Java Deserialization Apocalypse went viral
  • Now - OWASP Top 10: A08:2021-Software and Data Integrity Failures

Attack Types

Object Injection

Modifying serialized data so the server receives unintended information upon deserialization.

Example: Modifying a serialized object containing user role to gain admin privileges.

Remote Code Execution

Supplying a serialized payload that results in command execution upon deserialization.

Identifying Serialization

White-Box (Source Code Access)

Look for specific function calls:

Language Function
PHP unserialize()
Python Pickle pickle.loads()
Python JSONPickle jsonpickle.decode()
Python PyYAML yaml.load()
Java readObject()
C# / .NET Deserialize()
Ruby Marshal.load()

Black-Box (No Source Code)

Identify serialized data by format:

Format Language/Protocol
a:4:{i:0;s:4:"Test";...} PHP
(lp0\nS'Test'\np1\n... Pickle Protocol 0 (Python 2.x default)
Hex: 80 01 ... . Pickle Protocol 1 (Python 2.x)
Hex: 80 02 ... . Pickle Protocol 2 (Python 2.3+)
Hex: 80 03 ... . Pickle Protocol 3 (Python 3.0-3.7 default)
Hex: 80 04 95 ... . Pickle Protocol 4 (Python 3.8+ default)
Hex: 80 05 95 ... . Pickle Protocol 5 (Python 3.x)
["Test", "Data", [4], "ACADEMY"] JSONPickle (Python 2.7/3.6+)
- Test\n- Data\n... PyYAML / ruamel.yaml
Hex: AC ED 00 05 73 72 / Base64: rO0ABXNy Java
Hex: 00 01 00 00 00 ff ff ff ff / Base64: AAEAAAD///// C# / .NET
Hex: 04 08 Ruby

Tools

  • Freddy - Burp Suite extension for detecting and exploiting Java/.NET serialization
  • ysoserial - Java deserialization payload generator

Identifying Language from Serialized Data

Example: Ruby Detection

echo 'BAhbD2kGaQdpCGkJaQppC2kMaQ1pDmkA' | base64 -d | xxd
00000000: 0408 5b0f 6906 6907 6908 6909 690a 690b  ..[.i.i.i.i.i.i.
00000010: 690c 690d 690e 6900                      i.i.i.i.

Hex bytes starting with 04 08 → Ruby