CVE-2018-15133-PoC

This Python script implements a remote code execution (RCE) exploit for vulnerable Laravel applications through insecure deserialization, based on the CVE-2018-15133 vulnerability.

The exploit takes advantage of a vulnerability in Laravel (versions 5.5.40 and earlier, and 5.6.0 to 5.6.29) where encrypted sessions are automatically deserialized without proper validation. With access to the Laravel APP_KEY, an attacker can encrypt malicious payloads that will be deserialized and executed on the server.

How the Laravel Session System Works

Laravel uses a symmetric encryption mechanism for sessions with three components:

• IV (Initialization Vector): Random initialization vector generated for each session

• Value: Value encrypted using AES-128-CBC or AES-256-CBC

• MAC: Message authentication code (HMAC-SHA256) computed over IV + value + APP_KEY

Process:

• Receives three input parameters: the Laravel APP_KEY in base64, the command to execute, and the target domain

• Invokes the PHPGGC tool with the Laravel/RCE5 gadget chain to generate a chain of malicious PHP objects

• Builds the operating system command that will be executed on the victim server (e.g., system('whoami');)

• Generates the serialized PHP payload containing the chained gadgets

• Decodes the payload from base64 to binary format

• Processes the APP_KEY by removing the "base64:" prefix if present

• Adds the necessary padding to make the key valid base64

• Decodes the key from base64 to bytes

• Generates a random 16-byte initialization vector (IV)

• Encrypts the payload using AES in CBC mode with the key and the IV

• Applies PKCS7 padding to the payload before encryption

• Encodes the IV in base64

• Encodes the ciphertext (encrypted payload) in base64

• Concatenates the IV and value in base64 as the message for the HMAC

• Computes the MAC using HMAC-SHA256 over the concatenated message with the key as the secret

• Builds a JSON object with three fields: iv, value, and mac

• Encodes the entire JSON in base64

• Constructs an HTTP request using curl with the payload in the laravel_session cookie

• Sends the request to the target domain

• The Laravel server receives the cookie and decodes the base64

• Laravel verifies the MAC integrity against the received IV and value

• Laravel decrypts the content using AES-CBC with its APP_KEY

• Laravel automatically deserializes the decrypted content

• PHP invokes the __destruct() or __wakeup() magic methods of the deserialized objects

• The gadget chain is triggered, culminating in call_user_func() or eval()

• The operating system command is executed on the server

The exploit uses gadget chains that chain calls to PHP magic methods:

During deserialization, PHP automatically invokes __destruct() or __wakeup(), starting the chain that culminates in eval() executing arbitrary code.

Prerequisites For the exploit to work, the attacker needs:

• The Laravel APP_KEY (obtained through leaking environment variables, exposed S3 buckets, source code, etc.)

• A vulnerable version of Laravel with deserialization enabled by default

• PHPGGC installed in the ./phpggc/ directory https://github.com/ambionics/phpggc

Example Usage

python exploit.py "base64:dGhpc2lzYXNlY3JldGtleQ==" "whoami" "http://target.htb"
Este comando generará un payload serializado que ejecutará whoami cuando Laravel deserialice la sesión.