Panda's Blog
Menu

Legacy Archive Page

Article List · Page 3

A static article list retained for compatibility with legacy pagination URLs.

Follow My WeChat Official Account

Why did I start this official account? Traditional blogs no longer fully meet the needs of mobile readers. People increasingly prefer to use spare moments to read on their phones, which gave me the idea of creating a mobile platform. Blogging has been a habit of mine for nearly ten years, although my earlier writing appeared under another handle. When I was learning, I was deeply grateful to the people who willingly shared their knowledge, so once I became able to share what I had learned, I did not want to hold back…

A Study of the Serialization Process

0x01 Preface This article is detailed; copy the demo and follow in a debugger. 0x02 Flow Analysis Serialization writes an object to an I/O stream. It usually begins by creating ObjectOutputStream and calling its write…

Notes on the Object Serialization Stream Protocol

0. Preface This article mainly translates the Object Serialization Stream Protocol and summarizes the serialization format. 1. Overview The stream format has the following design goals: a compact structure for efficient reading; the ability to use the stream structure and format without detailed knowledge of the stream or invoking class code; and access and manipulation only through the stream…

Notes on the JDK 7u21 Deserialization Vulnerability

0x01 Preface The construction of the native JDK 7u21 gadget chain is a classic. After studying its structure and underlying ideas, I wrote this article as a set of notes. 0x02 Prerequisites The JDK 7u21 chain uses many fundamental Java concepts, principally Java reflection, dynamic class modification with Javassist, Java static class loading, Java dynamic proxies, and hash collisions. To make the article easier to follow, I will…

WeEngine CMS: From SQL Injection to RCE

0x01 Preface. WeEngine CMS quietly fixed an SQL injection vulnerability in version 2.0. No analysis of the injection point could be found online, so this article examines its exploitation. 0x02 Affected versions. Testing shows the vulnerability in v1.5.2 from the official GitLee repository and a fix in 2.0, so at least v1.5.2 is affected…

Analyzing Remote Code Execution in Qishi CMS

0x00 Preface. Xu recently told me Qishi CMS had patched a problem in the global assign_resume_tpl function and asked whether it was exploitable. The official advisory points to /Application/Common/Controller/BaseController…

Notes on PHP's register_argc_argv Configuration

0x01 Preface During a recent Dianfeng Geek CTF, I encountered a web challenge hinting at register_argc_argv but could not solve it. I later asked yzddmr6 and searched Chinese security research, finding little. This PHP setting seemed worth documenting. My practical experience is limited, so additions are welcome…

Getting a Shell from a Low-Privilege FastAdmin Admin Account

0x01 Preface. Xu recently pointed out a path from a low-privilege FastAdmin backend account to a shell. This article analyzes it. Affected versions: V1.0.0.20191212 beta and earlier. 0x02 Authorization. The main difficulty is that low-privilege users cannot access shell-related features…

Analyzing a Front-End Shell Upload Vulnerability in the Latest FastAdmin

Affected version: V1.0.0.20200506 beta, the latest release. Requirement: the member center must be enabled in /application/config.php. Vulnerability analysis: lines 58–67 of /application/index/User.php. user_request_empty is a developer hook and can be ignored; the important part is return $thi…