Apache Shiro padding oracle attack漏洞复现

Shiro uses AES-128-CBC mode to encrypt cookies, resulting in malicious users who can construct serialized data through padding oracle attacks for deserialization.

For example, the SHIRO-550 vulnerability that was exposed before is a problem with the remember cookie.

环境搭建

shiro package environment download address https://github.com/jas502n/SHIRO-721

exp Download address https://github.com/Geekby/shiro_rce_exp

Reproduce environment: ubuntu16.04 + tomcat8 + shiro 1.4.1

1

apt-get install tomcat8 tomcat8-docs tomcat8-examples tomcat8-admin

Then deploy the downloaded samples-web-1.4.1.war package to tomcat.

漏洞复现

Visit the shiro login page

Enter the username and password, click Remember Me

Visit any page to get the rememberMe in the cookie

Generate java class payload

Execute exp

Get the cookie after padding oracle attack

Note: The cracking time is long, lasting about 100min - 120min.

Copy the cookie and replay the packet

Check the execution results

Found that the success file was successfully created and the command can be executed

参考

https://www.anquanke.com/post/id/192819

https://github.com/jas502n/SHIRO-721

https://github.com/wuppp/shiro_rce_exp