Building an unmarshelling chain from hydrators#

Speakers not listed in the program text (companion outline: "Exploitation by using laravel-crypto-killer")

• Why: A reproducible unserialize-to-RCE chain in one of the most-deployed PHP stacks, with a shipping product vulnerable by default, is a concrete at-scale risk worth understanding even outside web-appsec focus.
• What: A three-step Livewire (Laravel) chain to remote command execution given the APP_KEY: first a phpinfo leak via FnStream / ShardedPrefixPublicUrlGenerator, then RCE via SerializableClosure / Queueable / BroadcastEvent gadgets, and finally a rebuilt chain reaching a Terminal-initiated exit so the request completes normally (no error 500) for stealth. The whole process is automated in a new exploit mode of synacktiv's laravel-crypto-killer; invoiceninja ships a default APP_KEY and is vulnerable by default. (from abstract only)
• How: Gadget-chain analysis across GuzzleHttp, League Flysystem, and Laravel framework classes, with payload construction on Livewire's hydration mechanism.
• Where applicable: Laravel/Livewire applications where APP_KEY is known, leaked, or default; org-agnostic but framework-specific.