search

yaklang / yakit

Cyber Security ALL-IN-ONE Platform
GNU Affero General Public License v3.0
6.64k stars 831 forks source link

shiro-gcm漏洞靶场有bug #1978

Open pwnhxl opened 2 months ago

pwnhxl commented 2 months ago

http://192.168.0.102:8787/shiro/gcm

DQCDO7mdQ3IWD0VxXYBc9Lf45NQSZqYpvsyW1eErrcixmIL9lQauwpzXBy3cGnPsDvtovnH+SJlg0hOqPhnDuN75AWloU+Hm8MTWteu/fKCq4wxxQCBrlrRQRyph+/ajQlqb5TS8zlzQzXcFEixU6EcN6qHaaVzR6T9IXdC7qlEgXYflIavircb64HMK5L0pJswJG1Z92/++Kqb7

Key: 2itfW92XazYRi5ltW0M2yA==

如图 gcm加密模式的靶场只有这个被动插件能检出 其他任何shiro检测工具都检测不出来 并且你们扫描出来的payload 用这个蓝队分析工具也解密不出来了 几个月前我测试的时候不这样的 最新版才有这个bug

shiro-1 shiro-2
Go0p commented 1 month ago

感谢反馈，确实有点问题，后续完成修复