{"guid":"798573a8-f544-48f0-abaf-ebc405f03f4a","title":"Exploiting PHP7 unserialize","subtitle":"teaching a new dog old tricks","slug":"33c3-7858-exploiting_php7_unserialize","link":"https://fahrplan.events.ccc.de/congress/2016/Fahrplan/events/7858.html","description":"PHP-7 is a new version of the most prevalent server-side language in use today. Like previous version, this version is also vulnerable to memory corruptions.\nHowever, the language has gone through extensive changes and none of previous exploitation techniques are relevant.\nIn this talk, we explore the new memory internals of the language from exploiters and vulnerability researchers point of view. We will explain newly found vulnerabilities in the 'unserialize' mechanism of the language and present re-usable primitives for remote exploitation of these vulnerabilities.","original_language":"eng","persons":["Yannay Livneh"],"view_count":5290,"promoted":false,"date":"2016-12-27T12:45:00.000+01:00","release_date":"2016-12-27T01:00:00.000+01:00","updated_at":"2026-04-22T19:30:06.543+02:00","tags":["Security"],"length":2641,"duration":2641,"thumb_url":"https://static.media.ccc.de/media/congress/2016/7858-hd.jpg","poster_url":"https://static.media.ccc.de/media/congress/2016/7858-hd_preview.jpg","timeline_url":"https://static.media.ccc.de/media/congress/2016/798573a8-f544-48f0-abaf-ebc405f03f4a-timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/congress/2016/798573a8-f544-48f0-abaf-ebc405f03f4a-thumbnails.vtt","frontend_link":"https://media.ccc.de/v/33c3-7858-exploiting_php7_unserialize","url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_title":"33C3: works for me","conference_url":"https://api.media.ccc.de/public/conferences/33c3","related":[{"event_id":3597,"event_guid":"87092ad2-d3fd-4a37-bb58-1fe71217a06b","weight":41},{"event_id":3598,"event_guid":"f75d0531-ac47-4edd-99bd-9eadd836982a","weight":54},{"event_id":3599,"event_guid":"c54bec28-0cec-4472-9a0f-36be8b626dd7","weight":59},{"event_id":3601,"event_guid":"5a517be2-220b-4eb6-88c3-e7ef08c98ace","weight":79},{"event_id":3602,"event_guid":"48e016a4-5683-4bda-8976-98f1dbf62787","weight":34},{"event_id":3604,"event_guid":"1275f046-e52e-4b0b-9f5b-7eb2008b2ec4","weight":46},{"event_id":3605,"event_guid":"61f9d4c6-a3de-4958-a57c-efcf941668fa","weight":44},{"event_id":3606,"event_guid":"1aa7a4c5-1a3f-444f-99fb-e9c7b4744794","weight":62},{"event_id":3607,"event_guid":"64c07cb5-ec19-4972-a2c8-96c0e0df83c6","weight":51},{"event_id":3609,"event_guid":"1efa803c-d280-49f0-bd17-8ec8f28e054f","weight":26},{"event_id":3610,"event_guid":"56537f49-c8f0-4d73-bdba-d4d8307fc170","weight":34},{"event_id":3612,"event_guid":"c92203a0-9158-4111-ab52-5dacd0e46c73","weight":28},{"event_id":3615,"event_guid":"74783236-46f4-493c-9574-1b27a44847b7","weight":75},{"event_id":3629,"event_guid":"686b1941-b211-4902-b4c4-1d642398e08b","weight":39},{"event_id":3640,"event_guid":"700a07e7-a9c4-437b-a4c5-4491b23a9b4a","weight":39},{"event_id":3654,"event_guid":"ac80424a-f4dc-431d-95f3-3f85664ba2dc","weight":25},{"event_id":3656,"event_guid":"1a6657a2-b6c2-4acc-b8fc-5ec081c0877f","weight":25},{"event_id":3671,"event_guid":"4ef69e6a-026f-4b30-888d-af654b220a3d","weight":26},{"event_id":3692,"event_guid":"f21478d4-e8db-4f19-854c-2f74b5824706","weight":46},{"event_id":3695,"event_guid":"c300b194-2a85-4705-92aa-b4e789882303","weight":28},{"event_id":3762,"event_guid":"25e2df7d-5740-4c2f-bc34-986326d606fe","weight":36}],"recordings":[{"size":null,"length":null,"mime_type":"application/x-subrip","language":"fin","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize.fi.srt","state":"translated","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2023-09-02T09:53:55.704+02:00","recording_url":"https://cdn.media.ccc.de/congress/2016/33c3-7858-eng-deu-Exploiting_PHP7_unserialize.fi.srt","url":"https://api.media.ccc.de/public/recordings/64251","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":null,"length":null,"mime_type":"application/x-subrip","language":"eng","filename":"DRAFT_33c3-7858-eng-deu-Exploiting_PHP7_unserialize.en_DRAFT.srt","state":"todo","folder":"","high_quality":true,"width":null,"height":null,"updated_at":"2022-01-14T19:33:19.240+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/DRAFT_33c3-7858-eng-deu-Exploiting_PHP7_unserialize.en_DRAFT.srt","url":"https://api.media.ccc.de/public/recordings/51120","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":174,"length":2641,"mime_type":"video/mp4","language":"eng","filename":"33c3-7858-eng-Exploiting_PHP7_unserialize.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-27T18:24:54.500+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7858-eng-Exploiting_PHP7_unserialize.mp4","url":"https://api.media.ccc.de/public/recordings/13530","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":204,"length":2641,"mime_type":"video/mp4","language":"deu","filename":"33c3-7858-deu-Exploiting_PHP7_unserialize.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-27T18:25:29.671+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7858-deu-Exploiting_PHP7_unserialize.mp4","url":"https://api.media.ccc.de/public/recordings/13531","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":265,"length":2641,"mime_type":"video/mp4","language":"eng-deu","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-27T18:26:01.962+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-hd/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_hd.mp4","url":"https://api.media.ccc.de/public/recordings/13532","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":95,"length":2641,"mime_type":"video/webm","language":"eng-deu","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-12-28T00:12:41.262+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/webm-sd/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/13650","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":108,"length":2641,"mime_type":"video/mp4","language":"eng-deu","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2016-12-28T00:26:49.036+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/h264-sd/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_sd.mp4","url":"https://api.media.ccc.de/public/recordings/13659","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":40,"length":2628,"mime_type":"audio/mpeg","language":"eng","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2016-12-28T14:58:10.105+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/mp3/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/13661","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":34,"length":2628,"mime_type":"audio/opus","language":"eng","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2016-12-28T14:58:10.178+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/opus/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_opus.opus","url":"https://api.media.ccc.de/public/recordings/13647","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"},{"size":193,"length":2641,"mime_type":"video/webm","language":"eng-deu","filename":"33c3-7858-eng-deu-Exploiting_PHP7_unserialize_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2016-12-28T12:33:59.379+01:00","recording_url":"https://cdn.media.ccc.de/congress/2016/webm-hd/33c3-7858-eng-deu-Exploiting_PHP7_unserialize_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/13698","event_url":"https://api.media.ccc.de/public/events/798573a8-f544-48f0-abaf-ebc405f03f4a","conference_url":"https://api.media.ccc.de/public/conferences/33c3"}]}