Lab 124 — SprintForge — Insecure Deserialization via Cookie Session + Debug Key Leak

hackadvisor

Task: Laravel 10.48.4 project management app with APP_DEBUG=true leaking APP_KEY via Ignition error page, and SESSION_DRIVER=cookie enabling deserialization. Solution: Extract APP_KEY from debug page, craft phpggc Laravel/RCE gadget chain, encrypt as Laravel cookie with AES-256-CBC, inject as laravel_session to trigger unserialize() RCE, exfiltrate flag via OOB curl to Interaction Server.