Apache Shiro RememberMe Deserialization

This is primarily an intentionally vulnerable lab, with a manual exploitation walkthrough rather than an automated exploit client. It reproduces CVE-2016-4437 using Apache Shiro 1.2.4's default CookieRememberMeManager, which retains the known AES key and deserializes attacker-controlled rememberMe cookie contents. The application includes Commons BeanUtils 1.9.2, supporting the documented CommonsBeanutils1 gadget. The walkthrough uses an external ysoserial JAR, a Java encryption snippet, and a forged HTTP cookie to execute the basic command touch /tmp/success. Maturity reflects this documented payload, not a packaged attack tool; execution was not independently verified. The 41 files include four Java application classes, three HTML templates, five shell checks, seven Terraform modules, a Ruby Vagrantfile, and a Dockerfile: 21 code/template files under this counting convention, excluding YAML/JSON/XML configuration. base/shiro/1.2.4 contains the Maven/Spring Boot application and image build recipe. ShiroConfig enables vulnerable default rememberMe handling; MainRealm hardcodes the demonstration credentials admin/vulhub; UserController supplies login, landing, and error routes. app contains the upstream Compose deployment and English/Chinese reproduction guides. isoloom.yml defines the lab, while .isoloom contains generated Docker, Kubernetes, VM, Proxmox, and six cloud-provider deployment outputs. GitHub workflows validate generated infrastructure, run availability/isolation checks, and register approved labs. checks/rememberme.sh only confirms rejection of an invalid cookie through rememberMe=deleteMe; it does not establish that the default key works or demonstrate deserialization RCE. Generated Docker deployments remove the application's default route, and Kubernetes manifests restrict egress when enforced by a compatible network plugin. The simpler upstream app/docker-compose.yml lacks these isolation measures. Kubernetes also publishes port 8080 through a LoadBalancer. No malicious callback, persistence, or exfiltration destination is present. Provisioning cleanup commands are contextual deployment/CI operations, not evidence of a fake exploit. The runtime image is pinned by tag rather than digest. The supplied data identifies upstream Vulhub commit 8fd63916f7a8711e2e01dda0d27237e4d6175d38, but does not provide the analyzed repository's original URL, analyzed git reference, or archive size; corresponding metadata is left empty or zero.

This repository contains a single Metasploit module targeting Apache Shiro v1.2.4's deserialization vulnerability (CVE-2016-4437). The exploit leverages a weakness in the rememberMe cookie handling, where a known or guessable encryption key allows attackers to craft a malicious Java serialized payload. This payload is encrypted and placed in the rememberMe cookie, which is then sent via an HTTP request to the target application. If the target is vulnerable, the payload is deserialized and executed, resulting in remote code execution. The module supports both Unix and Windows command payloads, including reverse shells. The main entry point is the Ruby file implementing the Metasploit exploit logic. The only fingerprintable endpoints are the HTTP base path (TARGETURI) and the rememberMe cookie. The exploit is weaponized, as it is part of the Metasploit framework and supports customizable payloads.

This repository is a comprehensive exploitation toolkit for Apache Shiro <= 1.2.4 (CVE-2016-4437), focusing on the 'rememberMe' deserialization vulnerability. It provides multiple Python scripts for different attack stages: key/module brute-forcing (shiro_crack.py, shiro_piliang_crack.py), remote code execution (shiro-rce/shiro_rce.py, shiro_shuyu/shiro_rce.py), reverse shell access (shiro_getshell/shiro_getshell.py), and detection/fuzzing (fuzz-shiro/check_shiro.py, thread_check.py). The core technique is to generate malicious serialized Java objects (using ysoserial.jar) encrypted with various known Shiro keys, and deliver them via the 'rememberMe' cookie in HTTP requests. The toolkit supports both single-target and batch exploitation, and includes modules for different gadget chains (CommonsBeanutils1, CommonsCollections1-6, JRMPClient). The repository is operational and can be used to achieve full remote code execution and shell access on vulnerable Shiro deployments.

This repository provides a Python-based exploit tool ('shisoserial.py') targeting Apache Shiro deserialization vulnerabilities, specifically CVE-2016-4437. The tool can: - Check if a target web application is using the Shiro framework by probing for the 'rememberMe' cookie behavior. - Brute-force the Shiro encryption key using a built-in dictionary ('lib/shiro_keys.txt') or a user-supplied key. - Generate and deliver ysoserial-based Java deserialization payloads (using either CBC or GCM encryption) to exploit vulnerable Shiro instances, enabling remote command execution (default command: 'whoami', customizable by the user). - Support batch targeting via a file of URLs, proxy configuration, POST/GET methods, and multithreading for mass exploitation. The main entry point is 'shisoserial.py', which implements all exploit logic and command-line parsing. The repository also includes documentation in both English and Chinese, a requirements file for dependencies, and a list of common Shiro keys. The attack vector is network-based, targeting web applications over HTTP/HTTPS. The tool is operational and provides real exploitation capabilities, not just detection.