<- Back to the timetable

Exploiting PHP7 unserialize

Yannay Livneh

PHP is the most prominent web server-side language used today. Although secure coding practices are used when developing in PHP, they can’t mitigate vulnerabilities in the language itself. Since PHP is written in C, it is exposed to vulnerabilities found in projects written in a low-level language, such as memory-corruption vulnerabilities, which are common when manipulating data formats. PHP-7 is a new implementation of the language, and while memory corruption bugs exist in this version as well, none of the exploitation primitives from the previous version are working (e.g. @i0n1c presentation from BH2010). In this talk, I will discuss the memory internals of PHP7 from exploiter and vulnerability researcher's perspective, explain newly found vulnerabilities in the unserialize mechanism and demonstrate how to exploit this class of bugs in PHP-7 presenting re-usable primitives. The internals of the language implementation changed quite dramatically, and now it’s harder to find and exploit memory corruption bugs. The new zval system prefers embedding over pointing to members and the allocation mechanism has gone through a complete re-write, removing metadata. The overall result is less primitives and less control over crafted data. unserialize is a data manipulation and object instantiation mechanism in PHP which is prone to memory corruption vulnerabilities. For the first time, we have managed to implement a remote exploit of a real world bug in PHP-7unserialize mechanism.

Download Slides
PDF ZIP JSON
0:00:07 - 0:00:12
0:01:13 - 0:01:17
0:01:24 - 0:01:26
0:01:36 - 0:01:40
0:01:41 - 0:01:46
0:01:46 - 0:01:53
0:01:54 - 0:01:57
0:02:01 - 0:02:06
0:02:06 - 0:02:21
0:02:21 - 0:02:36
0:02:37 - 0:02:43
0:02:44 - 0:02:52
0:02:53 - 0:02:55
0:02:56 - 0:03:03
0:03:03 - 0:03:20
0:03:20 - 0:03:33
0:03:33 - 0:03:36
0:03:36 - 0:03:39
0:03:39 - 0:03:55
0:03:56 - 0:04:06
0:04:07 - 0:04:18
0:04:32 - 0:04:43
0:04:50 - 0:04:54
0:04:54 - 0:04:58
0:05:04 - 0:05:16
0:05:16 - 0:05:18
0:05:20 - 0:05:23
0:05:26 - 0:05:28
0:05:30 - 0:05:32
0:05:33 - 0:05:46
0:05:46 - 0:05:53
0:05:56 - 0:05:59
0:05:59 - 0:06:04
0:06:04 - 0:06:10
0:06:11 - 0:06:14
0:06:16 - 0:06:22
0:06:24 - 0:06:29
0:06:36 - 0:06:40
0:06:43 - 0:06:52
0:06:59 - 0:07:09
0:07:13 - 0:07:41
0:07:41 - 0:07:44
0:07:47 - 0:07:50
0:07:51 - 0:07:55
0:07:55 - 0:08:01
0:08:11 - 0:08:16
0:08:19 - 0:08:27
0:08:28 - 0:08:53
0:08:54 - 0:08:57
0:08:58 - 0:09:04
0:09:05 - 0:09:29
0:09:39 - 0:09:51
0:09:52 - 0:09:56
0:09:57 - 0:10:01
0:10:03 - 0:10:09
0:10:09 - 0:10:16
0:10:17 - 0:10:23
0:10:23 - 0:10:41
0:10:41 - 0:10:46
0:10:47 - 0:11:13
0:11:15 - 0:11:19
0:11:27 - 0:11:32
0:11:35 - 0:11:38
0:11:50 - 0:11:55
0:12:02 - 0:12:06
0:12:07 - 0:12:10
0:12:14 - 0:12:19
0:12:20 - 0:12:23
0:12:34 - 0:12:40
0:12:42 - 0:12:45
0:13:01 - 0:13:09
0:13:18 - 0:13:22
0:13:27 - 0:13:32
0:13:33 - 0:13:44
0:13:44 - 0:13:56
0:13:56 - 0:13:59
0:14:03 - 0:14:12
0:14:13 - 0:14:22
0:14:22 - 0:14:32
0:14:32 - 0:14:38
0:14:38 - 0:14:41
0:14:41 - 0:14:49
0:14:49 - 0:15:16
0:15:17 - 0:15:20
0:15:21 - 0:15:23
0:15:25 - 0:15:28
0:15:33 - 0:15:51
0:15:53 - 0:16:03
0:16:12 - 0:16:22
0:16:25 - 0:16:28
0:16:29 - 0:16:32
0:16:32 - 0:16:38
0:16:38 - 0:16:41
0:16:42 - 0:16:45
0:16:50 - 0:16:57
0:16:57 - 0:17:08
0:17:08 - 0:17:27
0:17:29 - 0:17:33
0:17:34 - 0:17:41
0:17:42 - 0:17:46
0:17:46 - 0:17:56
0:17:58 - 0:18:03
0:18:04 - 0:18:16
0:18:16 - 0:18:19
0:18:19 - 0:18:24
0:18:31 - 0:18:40
0:18:47 - 0:18:49
0:19:15 - 0:19:30
0:19:34 - 0:19:51
0:20:20 - 0:20:39
0:20:39 - 0:20:48
0:20:49 - 0:21:10
0:21:11 - 0:21:15
0:21:19 - 0:21:22
0:21:25 - 0:21:33
0:21:34 - 0:21:39
0:21:50 - 0:22:32
0:22:32 - 0:22:35
0:22:35 - 0:22:37
0:22:37 - 0:22:41
0:22:42 - 0:22:46
0:22:46 - 0:22:55
0:22:55 - 0:23:00
0:23:00 - 0:23:13
0:23:13 - 0:23:17
0:23:19 - 0:23:30
0:23:59 - 0:24:56
0:24:59 - 0:25:01
0:25:06 - 0:25:10
0:25:10 - 0:25:14
0:25:15 - 0:25:17
0:25:23 - 0:25:28
0:25:32 - 0:25:38
0:25:40 - 0:25:45
0:25:45 - 0:25:48
0:25:49 - 0:25:58
0:26:03 - 0:26:28
0:26:30 - 0:26:33
0:26:38 - 0:27:02
0:27:09 - 0:27:19
0:27:21 - 0:27:25
0:27:32 - 0:27:40
0:27:40 - 0:28:00
0:28:02 - 0:28:05
0:28:06 - 0:28:17
0:28:17 - 0:28:24
0:28:27 - 0:28:29
0:28:30 - 0:28:33
0:28:34 - 0:28:37
0:28:38 - 0:28:42
0:28:49 - 0:29:06
0:29:07 - 0:29:13
0:29:19 - 0:29:22
0:29:23 - 0:29:25
0:29:29 - 0:29:35
0:29:39 - 0:29:42
0:29:47 - 0:29:56
0:30:06 - 0:30:19
0:30:19 - 0:30:25
0:30:26 - 0:30:28
0:30:29 - 0:30:34
0:30:36 - 0:30:46
0:30:54 - 0:31:03
0:31:10 - 0:31:13
0:31:17 - 0:31:22
0:31:24 - 0:31:29
0:31:36 - 0:31:43
0:31:45 - 0:31:50
0:31:58 - 0:32:01
0:32:01 - 0:32:08
0:32:09 - 0:32:12
0:32:17 - 0:32:22
0:32:26 - 0:32:31
0:32:32 - 0:32:43
0:32:44 - 0:32:51
0:32:51 - 0:33:02
0:33:03 - 0:33:10
0:33:14 - 0:33:19
0:33:27 - 0:33:36
0:33:37 - 0:33:46
0:33:46 - 0:33:49
0:33:59 - 0:34:10
0:34:19 - 0:34:24
0:34:25 - 0:34:30
0:34:31 - 0:34:36
0:34:36 - 0:34:41
0:34:43 - 0:34:47
0:34:47 - 0:34:53
0:34:56 - 0:35:01
0:35:03 - 0:35:15
0:35:21 - 0:35:24
0:35:25 - 0:35:30
0:35:37 - 0:35:43
0:35:44 - 0:36:04
0:36:13 - 0:36:17
0:36:18 - 0:36:22
0:36:23 - 0:36:35
0:36:36 - 0:36:44
0:36:45 - 0:36:48
0:36:48 - 0:37:02
0:37:06 - 0:37:11
0:37:14 - 0:37:21
0:37:26 - 0:37:34
0:37:35 - 0:37:43
0:37:45 - 0:37:52
0:37:52 - 0:38:01
0:38:05 - 0:38:16
0:38:17 - 0:38:21
0:38:22 - 0:38:24
0:38:35 - 0:38:46
0:38:55 - 0:39:04
0:39:15 - 0:39:24
0:39:38 - 0:39:43
0:39:48 - 0:39:50
0:39:51 - 0:39:54
0:39:57 - 0:40:00
0:40:01 - 0:40:06
0:40:09 - 0:40:11
0:40:14 - 0:40:22
0:40:23 - 0:40:31
0:40:41 - 0:40:45
0:41:17 - 0:41:25
0:41:34 - 0:41:41
0:43:45 - 0:43:49
0:43:50 - 0:43:54
0:43:55 - 0:44:00