search

Anemone95 / anemone95.github.io

http://anemone.top/
2 stars 1 forks source link

Shiro v1.4.0反序列化 | Anemone's Blog #74

Open Anemone95 opened 4 years ago

Anemone95 commented 4 years ago

https://anemone.top/vulnresearch-Shrio1.4.0PaddingOracle%E5%AF%BC%E8%87%B4%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96/#more

原理shiro1.2.5后秘钥不再硬编码，但是采用CBC加密会产生padding oracle攻击，又因为java序列化结构体后可以加垃圾字符，所以攻击能够成功解密时的调用链1234567891011121314org.apache.shiro.mgt.AbstractRememberMeManager#convertBytesToPrincipals // 不论哪个异常都会返回null，上层3