Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Using PHAR deserialization to deploy a custom gadget chain

Nguyễn | Last updated: Jul 14, 2022 03:20AM UTC

I think that the solution of this lab is wrong in item number 4 [Notice that the file_exists() filesystem method is called on the lockFilePath attribute]. In my opinion, its chain will implement the following flow: avatar.php?avatar=phar://image -> Blog -> function __wakeup() of Blog -> CustomTemplate -> function __destruct of CustomTemplate -> function lockFilePath() of CustomTemplate -> function __toString () of Blog. So how is file_exists in function isTemplateLocked() of class CustomTemplate called while function isTemplateLocked() is not magic method?

Phan | Last updated: Jul 14, 2022 09:58AM UTC