Livewire Remote Command Execution via Unmarshaling (Hydratio...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/publications/livewire-execution-de-commandes-a-distance-via-unmarshaling.html
• Blog Title: Livewire: Remote Command Execution via Unmarshaling (Hydration, Synthesizers and CVE-2025-54068)
• Suggested Section: pentesting-web -> Deserialization (new subsection for "Laravel / Livewire hydration & synthesizer abuse" or a dedicated "Pentesting Web -> Laravel / Livewire" page referencing deserialization and RCE gadget chains)

🎯 Content Summary

Overview and Impact
The blog analyzes Laravel Livewire 3’s hydration/unmarshaling mechanism and shows how it can be abused for remote command execution (RCE) in two ways:
• A design flaw that gives RCE when an attacker knows the Laravel APP_KEY by forging Livewire snapshots and abusing synthesizers plus Laravel deserialization gadgets.
• CVE-2025-54068: an unauthenticated RCE in Livewire 3 that does no...

🔧 Technical Details

Turning Livewire Hydration and Synthesizers into a Generic Object-Instantiation Primitive
Livewire represents complex component properties using synthetic tuples of the form [value, {"s":"<key>", ...meta}], where s identifies a synthesizer such as clctn, form or mdl. The core hydrate() function checks each value with isSyntheticTuple() and dispatches to the corresponding synthesizer, passing a recursive $hydrateChild callback that re-invokes hydrate() on nested children. By crafting JSON that uses tuples like [data,{"s":"clctn","class":"Some\\Class"}], an attacker can cause Livewire to instantiate arbitrary classes with controlled constructor parameters and recursively hydrated child objects. This converts Livewire’s hydration into a powerful generic object-instantiation engine that can be directed to build gadget graph...

🤖 Agent Actions

Summary:

• Added a new page (pentesting-web/deserialization/livewire-hydration-synthesizer-abuse.md) detailing how Livewire’s hydration, synthesizers, and Queueable/SerializableClosure gadgets can be weaponized both with a known APP_KEY and via CVE-2025-54068. The page covers snapshot forging, synth primitives, phpggc-based gadget chains, tool-assisted exploitation (laravel-crypto-killer & Livepyre), and defensive guidance, with full references.
• Updated the main deserialization README to link to the new Livewire-focused content so it’s discoverable from the PHP section.

Testing:

• Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 936
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/publications/livewire-execution-de-commandes-a-distance-via-unmarshaling.html

Content Categories: Based on the analysis, this content was categorized under "pentesting-web -> Deserialization (new subsection for "Laravel / Livewire hydration & synthesizer abuse" or a dedicated "Pentesting Web -> Laravel / Livewire" page referencing deserialization and RCE gadget chains)".

Repository Maintenance:

• MD Files Formatting: 936 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0