PHP serialize() for object injection - php

Question

I'm currently analyzing the PHP exploitation method called PHP Object Injection, which allows for modification of already defined objects due to unsanitized input in unserialize() function.
Here is the code:
<?php
class foo {}
class SuperClass {}
$ss = 'O:3:"foo":2:{s:4:"test";b:1;s:2:"fg";O:10:"SuperClass":0:{}};';
print_r(unserialize($ss));
?>
Which produces the following output:
foo Object
(
[test] => 1
[fg] => SuperClass Object
(
)
)
My question is, how would I recreate the object structure that I could pass to serialize() function that would create the same input string? PHP doesn't allow nested classes, so I'm quite puzzled as to if it is even possible to generate such string with serialize()?
Here is how I would do it, but due to PHP not allowing nested classes, it won't work:
class foo {
public $test = 1;
public $fg = class SuperClass {
}
}
echo serialize(new foo);

Answer 1

If you want to see how PHP will serialize a class structure like that, and that is what I assume you are asking then create your classes like this
<?php
class SuperClass
{
public $name = 'SuperClass';
}
class foo
{
public $name = 'foo';
public $test = 1;
}
$s = new SuperClass();
$f = new foo();
$s->fg = $f;
$ss = serialize($s);
echo $ss . PHP_EOL;
$hydrated = unserialize($ss);
print_r($hydrated);
This produces the following output
O:10:"SuperClass":2:{s:4:"name";s:10:"SuperClass";s:2:"fg";O:3:"foo":2:{s:4:"name";s:3:"foo";s:4:"test";i:1;}}
SuperClass Object
(
[name] => SuperClass
[fg] => foo Object
(
[name] => foo
[test] => 1
)
)
You can play with this to see how to manipulate the serialized string to add whatever content to the string to make the objects contain whatever you want.

Answer 2

Probably the fields needs to be an instance of the class.
class foo {
public $test = 1;
public $fg = new SuperClass();
}
var_dump(serialize(new foo()));
Alternatively to your syntax, PHP7 provides anonymous classes functionality
public $fg = new class() extends SuperClass {
// some additional implementation here
}
So you can add fields which later will be presented in the serialized string. In the current example none are present.