#NullconBerlin2025 | LiveWire: Remote Command Execution Through Unmarshalling by Rémi and Pierre

This talk focuses on LiveWire, a full-stack framework for Laravel that enhances the development of dynamic web interfaces by enabling real-time features using PHP and Blade templates. The speakers, Rémi Matasse and Pierre Martin, demonstrate how to exploit the unmarshalling mechanism in LiveWire, allowing for the instantiation of arbitrary objects that can lead to remote command execution in any LiveWire instance if the attacker possesses the application’s APP_KEY. They also introduce a new feature in their tool, laravel-crypto-killer, which automates the payload generation discussed during the presentation.