A library and tool to generate PHP unserialize() payloads for exploiting gadget chains in popular frameworks.
PHPGGC (PHP Generic Gadget Chains) is a security tool that provides a collection of pre-built exploit payloads targeting PHP's unserialize() function. It automates the generation of malicious serialized objects, enabling security researchers and penetration testers to efficiently test for and demonstrate deserialization vulnerabilities in PHP applications without manually crafting exploits.
Security researchers, penetration testers, and red teamers who need to identify and exploit PHP deserialization vulnerabilities in applications using frameworks like Laravel, Symfony, WordPress, or Drupal.
Developers choose PHPGGC over manual exploit crafting because it offers an extensive library of ready-to-use gadget chains for popular PHP frameworks, supports multiple exploit types (RCE, file operations), and includes features like PHAR payload generation and encoding obfuscation to bypass filters.
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Includes ready-to-use gadget chains for Laravel, Symfony, WordPress, Drupal, and over a dozen other frameworks, as listed in the 'phpggc -l' output, reducing manual research.
Supports RCE, file write, file read, and inclusion attacks via PHAR archives in PHAR, TAR, and ZIP formats, enabling exploitation through methods like file_exists().
Offers encoders for URL encoding, base64, and techniques like fast-destruct and plus-number obfuscation to bypass input filters, with chaining capabilities for complex evasion.
Provides tools like test-gc-compatibility.py to verify gadget chain compatibility across package versions, ensuring payload reliability in targeted environments.
README notes that ASCII Strings and Armor Strings encoders are experimental and may not work in all cases, reducing reliability for bypassing strict filters.
Only generates payloads; it doesn't scan for or detect vulnerable unserialize() points, requiring additional tools or manual analysis to find entry points.
Gadget chains are specific to frameworks and versions; unsupported or custom frameworks necessitate manual chain development, limiting out-of-the-box use.