Skip to content

Add support for allowed_classes optional parameter to unserialize #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Add support for allowed_classes optional parameter to unserialize #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
62692af
Modify PHP hooks to consider 'allowed_classes'
wunused Feb 2, 2023
d235c8c
Bugfix: prevent crash when classes list is empty
wunused Jun 19, 2023
b8671a4
Bugfix: prevent crash when classes list is empty
wunused Jun 19, 2023
8047a04
Hook fugio_unserialize for old PHP compatibility
wunused Jun 22, 2023
1ce85eb
Revert "Hook fugio_unserialize for old PHP compatibility"
wunused Jun 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions Analyzer/analyzer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -386,6 +386,10 @@ def preprocess(self, user_classes, user_functions, declared_interfaces,
f.write(b'?>')
self.target_file_list = self.s_analyzer.parse_file(EVAL_FILE)

# If PHP returns an empty array, Python treats it as a list.
if isinstance(user_classes, list):
user_classes = {}

target_class, target_function = \
self.d_analyzer.update_info(user_classes,
user_functions,
Expand Down Expand Up @@ -1153,6 +1157,11 @@ def write_code(item_name, item_info, cls=True, write=True):
class_list = []

declared_flag = False

# If PHP returns an empty array, Python treats it as a list.
if isinstance(user_classes, list):
user_classes = {}

for class_name, class_info in user_classes.items():
if not re.match(EXCLUDED_CLASSES_REGEX, class_name) and \
class_info['FILE_NAME'].startswith(self.target):
Expand Down
4 changes: 4 additions & 0 deletions Analyzer/dynamic.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,10 @@ def update_info(self, user_classes, user_functions, declared_classes,
new_func_info['FILE_NAME'] = func_file
target_function[func_name] = new_func_info

# If PHP returns an empty array, Python treats it as a list.
if isinstance(user_classes, list):
user_classes = {}

for class_name, class_info in user_classes.items():
if not re.match(EXCLUDED_CLASSES_REGEX, class_name):
file_name = class_info['FILE_NAME']
Expand Down
52 changes: 44 additions & 8 deletions Utils/HookFiles/HookHead.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,11 +151,13 @@ function get_class_props_r353t($clsname) {
return $class_props;
}

function get_user_classes_r353t() {
function get_user_classes_r353t($trigger_func, $func_argv) {
$user_classes = Array();
$declared_list = array_merge(get_declared_classes(),
get_declared_interfaces());
$declared_list = array_merge($declared_list, get_declared_traits());
$declared_list = array_merge(get_declared_classes(), get_declared_interfaces());
$declared_list = filter_allowed_classes(
array_merge($declared_list, get_declared_traits()),
$trigger_func,
$func_argv);
foreach ($declared_list as $clsname) {
$cls = new ReflectionClass($clsname);
$cls_org = $cls;
Expand Down Expand Up @@ -251,9 +253,9 @@ function isPharDetected_r353t($case, $validator_md5) {
return False;
}

function get_declared_classes_r353t() {
function get_declared_classes_r353t($trigger_func, $func_argv) {
$declared_classes = array();
foreach (get_declared_classes() as $clsname) {
foreach (filter_allowed_classes(get_declared_classes(), $trigger_func, $func_argv) as $clsname) {
$cls = new \ReflectionClass($clsname);
$clsname = str_replace("\0", "", $clsname);
$clsname = str_replace("/", "_", $clsname);
Expand Down Expand Up @@ -286,6 +288,25 @@ function get_declared_traits_r353t() {
return $traits;
}

function filter_allowed_classes($array, $trigger_func, $func_argv) {
$return_array = $array;
if ($trigger_func == "unserialize" && count($func_argv) > 1) {
if (array_key_exists("allowed_classes", $func_argv[1])) {
if (gettype($func_argv[1]["allowed_classes"]) == "boolean") {
if ($func_argv[1]["allowed_classes"] == false) {
$return_array = Array();
} else if ($func_argv[1]["allowed_classes"] == true) {
$return_array = $array;
}
} else if (gettype($func_argv[1]["allowed_classes"]) == "array") {
$allowed_classes = $func_argv[1]["allowed_classes"];
$return_array = array_intersect($array, $allowed_classes);
}
}
}
return $return_array;
}

function saveDatas_r353t($argv_list, $trigger_func, $func_argv, $inject_idxs) {
global $argv_list_r353t;
$inject_points = explode(",", $inject_idxs);
Expand Down Expand Up @@ -324,6 +345,21 @@ function saveDatas_r353t($argv_list, $trigger_func, $func_argv, $inject_idxs) {
$class_list = Array();
$pid_list = Array();

if ($trigger_func == "unserialize" && count($func_argv) > 1) {
if (array_key_exists("allowed_classes", $func_argv[1])) {
if (gettype($func_argv[1]["allowed_classes"]) == "boolean") {
if ($func_argv[1]["allowed_classes"] == false) {
$class_name_list = Array();
} else if ($func_argv[1]["allowed_classes"] == true) {
$class_name_list = $class_name_list;
}
} else if (gettype($func_argv[1]["allowed_classes"]) == "array") {
$allowed_classes = $func_argv[1]["allowed_classes"];
$class_name_list = array_intersect($class_name_list, $allowed_classes);
}
}
}

foreach($class_name_list as $cls_name) {
$pid = pcntl_fork();
// error_log("Fork: $cls_name\n");
Expand Down Expand Up @@ -396,10 +432,10 @@ class_exists($cls_name);

$argv_list_r353t['TRIGGER_FUNC'] = $trigger_func;
$argv_list_r353t['FUNC_ARGV'] = $func_argv;
$argv_list_r353t['CLASSES'] = get_declared_classes_r353t();
$argv_list_r353t['CLASSES'] = get_declared_classes_r353t($trigger_func, $func_argv);
$argv_list_r353t['INTERFACES'] = get_declared_interfaces_r353t();
$argv_list_r353t['TRAITS'] = get_declared_traits_r353t();
$argv_list_r353t['USER_CLASSES'] = get_user_classes_r353t();
$argv_list_r353t['USER_CLASSES'] = get_user_classes_r353t($trigger_func, $func_argv);
$argv_list_r353t['INCLUDED_FILES'] = get_included_files();
$copied_globals = new ArrayObject($GLOBALS);
$argv_list_r353t['GLOBALS'] = $copied_globals->getArrayCopy();
Expand Down