HTB CWPE: Insecure Deserialization and Template/Expression Injection

What this domain tests

Insecure Deserialization and Template/Expression Injection tests recognition and exploitation of object hydration and server-side expression evaluation. The exam distinguishes data-only serialization from magic-method or gadget-driven execution.

Core rules and concepts

• Identify the format: PHP O:4:'User':..., Java rO0AB or aced0005, Python pickle, .NET AAEAAAD, or JSON used as a serialized object.
• In PHP, look for __wakeup, __destruct, __toString, and __call; property values can change behavior without any code injection.
• Java exploitation needs a gadget chain matched to libraries and JDK version; ysoserial payload choice is version-sensitive.
• SSTI is engine-specific: Jinja2 {{7*7}}, Twig {{7*7}}, FreeMarker ${7*7}, Velocity #set($x=7*7). Escalation often uses globals or object traversal.
• Signatures and integrity checks must be tested; a valid signature over attacker data is still exploitable if the key is weak or exposed.
• Review cookies, hidden form fields, cache entries, and message queues for serialized state.

Worked example

A cookie contains Tzo0OiJVc2VyIjoxOntzOjU6InJvbGUiO3M6NDoidXNlciI7fQ==, which decodes to a PHP serialized User object with role=user. You change the string length to 5 for admin and re-encode: Tzo0OiJVc2VyIjoxOntzOjU6InJvbGUiO3M6NToiYWRtaW4iO30=. The reasoning is that the application unserializes the cookie and trusts the hydrated role property. No PHP code execution is needed; the vulnerability is object injection through trusted serialized state.

Traps that cost marks

• Breaking serialized string length prefixes when editing values.
• Testing SSTI only with {{7*7}} and ignoring engine error messages.
• Using a Java gadget chain without checking library versions.
• Treating base64 as encryption rather than encoding.