Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Using PHAR deserialization to deploy a custom gadget chain

Nguyễn | Last updated: Jul 14, 2022 03:20AM UTC

I think that the solution of this lab is wrong in item number 4 [Notice that the file_exists() filesystem method is called on the lockFilePath attribute]. In my opinion, its chain will implement the following flow: avatar.php?avatar=phar://image -> Blog -> function __wakeup() of Blog -> CustomTemplate -> function __destruct of CustomTemplate -> function lockFilePath() of CustomTemplate -> function __toString () of Blog. So how is file_exists in function isTemplateLocked() of class CustomTemplate called while function isTemplateLocked() is not magic method?

Phan | Last updated: Jul 14, 2022 09:58AM UTC

I have the same question as you. Hope the team will reply soon!!!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.