phpggc

PHPGGC: Cadenas de Gadgets Genéricas de PHP PHPGGC es una librería de payloads de unserialize junto con una herramienta para generarlos, desde la línea de comandos o programáticamente. Cuando te encuentras con un unserialize en un sitio web del que no tienes el código, o simplemente cuando intent...

wordpress-php-object-helper

wordpress-php-object-helper 关于 您有一个已知的带 PHP 对象漏洞的插件，但您需要确定使用哪个库来利用该问题并与 phpggc 配合运行。 这应该能帮到您。 示例输出 root@kitploit: $ python3 finder.py -u http://wordpress.lan -f wp-plugins.lst Processing URLs:...

CVE-2021-3129

CVE-2021-3129 Laravel Ignition 未授权远程代码执行（通过文件上传） CVE 概述 在受影响的 Laravel Ignition 版本中，攻击者可以利用 filegetcontents 和 fileputcontents 的不安全使用来执行任意代码。此漏洞仅对使用调试模式的网站可被利用。 受影响版本 Laravel Ignition 2.5.2 和 Laravel 8.4.2 注意事项 该漏洞需要 PHP 利用链，因此使用 phpggc。可以通过以下方式实现： 如果尚未克隆：git clone...

Laravel-8.4.2-rce-CVE-2021-3129

Laravel-8.4.2-rce-CVE-2021-3129 root@kitploit: exploit.py tested use python3,and only working with phpggc . first docker-compose up port on 8888 at 127.0.0.1 generate key first...

CVE-2018-15133-PoC

CVE-2018-15133-PoC 此 Python 脚本利用 CVE-2018-15133 漏洞，针对存在不安全反序列化漏洞的 Laravel 应用实现远程代码执行（RCE）。 该漏洞利用 Laravel（5.5.40 及更早版本，以及 5.6.0 至 5.6.29）中已加密的会话会自动反序列化且缺乏适当验证的弱点。在获取 Laravel 的 APPKEY 后，攻击者可加密恶意负载，这些负载将被反序列化并在服务器上执行。 Laravel 会话系统工作原理 Laravel 使用对称加密机制处理会话，包含三个组件： IV（初始化向量）：每次会话随机生成的初始化向量 Value：使用...

CVE-2024-40624

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

CVE-2024-40624 Deserialization of untrusted data in torrentpier/torrentpier

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to...

TorrentPier Deserialization of Untrusted Data vulnerability

Summary In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.phpL41-L60 PoC One can use...

GHSA-FG86-4C2R-7WXW TorrentPier Deserialization of Untrusted Data vulnerability

Summary In torrentpier/library/includes/functions.php, gettracks uses the unsafe native PHP serialization format to deserialize user-controlled cookies: https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.phpL41-L60 PoC One can use...

GHSA-PV9J-C53Q-H433 Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder

Summary Symfony 1 has a gadget chain due to dangerous unserialize in sfNamespacedParameterHolder class that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will...

Deserialization Gadget chain in Symfony sfNamespacedParameterHolder

Summary Symfony 1 has a gadget chain due to dangerous unserialize in sfNamespacedParameterHolder class that would enable an attacker to get remote code execution if a developer unserialize user input in his project. Details This vulnerability present no direct threat but is a vector that will...

Slider Revolution < 6.6.19 - Author+ Insecure Deserialization leading to RCE

Description The plugin does not prevent users with at least the Author role from unserializing arbitrary content when importing sliders, potentially leading to Remote Code Execution. 1. Make sure to configure the plugin so Authors can access its settings 2. Create a new slider. 3. Save and export...

WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...

Deserialization of arbitrary data leads to RCE

Description LibreNMS includes support for monitoring applications, one of which is memcached. When polling for memcached, the data returned by the agent to the LibreNMS server is not verified before it is deserialized. Because LibreNMS has quite a few dependencies, it is easy to find a working...

Laravel Framework RCE Vulnerability

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in...

Deserialization of untrusted data

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the emailrecipients property. By using a crafted request, they can create a malicious report, containin...

Exploit for CVE-2021-3129

LaravelCVE-2021-3129EXP Reference exp: https://github.com/...

Drupal vulnerability a combination of Boxing: by a malicious picture of a key RCE-vulnerability warning-the black bar safety net

One, Foreword Recent Drupal released two critical patches, support 7. x and 8. the x version. In this security update fixes some bugs, these bugs have been submitted to our targeted vulnerability incentive program TIPS. Exploitation of these vulnerabilities it is possible to achieve code executio...