PHP Magic Method enumeration for deserialization vulnerabilities. Adapted from https://nickbloor.co.uk/2018/02/28/popping-wordpress/

UniversalPOPGadget.php

# Credit for this: https://nickbloor.co.uk/2018/02/28/popping-wordpress/
# I just made them print statements instead of logging...
<?php
if(!class_exists("UniversalPOPGadget")) {
class UniversalPOPGadget {
	public function __construct() { echo "UniversalPOPGadget::__construct()\n"; }
	public function __destruct() { echo "UniversalPOPGadget::__destruct()\n"; }
	public function __call($name, $args) {
		echo "UniversalPOPGadget::__call(" . $name . ", " . implode(",", $args) . ")\n";
	}
	public static function __callStatic($name, $args) {
		echo "UniversalPOPGadget::__callStatic(" . $name . ", " . implode(",", $args)."\n";
	}
	public function __get($name) { echo "UniversalPOPGadget::__get(" . $name . ")\n"; }
	public function __set($name, $value) { echo "UniversalPOPGadget::__set(" . $name . ", " . $value . ")\n"; }
	public function __isset($name) { echo "UniversalPOPGadget::__isset(" . $name . ")\n"; }
	public function __unset($name) { echo "UniversalPOPGadget::__unset(" . $name . ")\n"; }
	public function __sleep() { echo "UniversalPOPGadget::__sleep()\n"; return array(); }
	public function __wakeup() {
		echo "UniversalPOPGadget::__wakeup()\n";
		echo "  [!] Defined classes:";
		foreach(get_declared_classes() as $c) {
			echo "    [+] " . $c;
		}
	}
	public function __toString() { echo "UniversalPOPGadget::__toString()\n"; }
	public function __invoke($param) { echo "UniversalPOPGadget::__invoke(" . $param . ")\n"; }
	public function __set_state($properties) {
		echo "UniversalPOPGadget::__set_state(" . implode(",", $properties) . ")\n";
	}
	public function __clone() { echo "UniversalPOPGadget::__clone()\n"; }
	public function __debugInfo() { echo "UniversalPOPGadget::__debugInfo()\n"; }
}}
?>