shisoserial — 一个针对shiro反序列化漏洞(CVE-2016-4437)的快速利用工具/A simple tool targeted at shiro framework attacks with ysoserial. | Kitploit

What is this

A simple tool targeted at shiro framework attacks with ysoserial.

Contributor

4nth0ny @Friday_lab

Runtime

python 3.x
JDK 1.8

Installation

python3 -m pip install -r requirements.txt

for AttributeError: module 'Crypto.Cipher.AES' has no attribute 'MODE_GCM' or No module named 'Crypto'

python3 -m pip uninstall crypto pycryptodome
python3 -m pip install pycryptodome

Usage

usage: shisoserial.py [-h] --mode MODE --url  [--type default:CBC] [--data] [--key] [--gadget] [--command default:whoami] [--proxies] [--ser] [--thread]

This is a simple tool to attack framework shiro with ysoserial

optional arguments:
  -h, --help            show this help message and exit
  --mode MODE, -m MODE  check/crack/yso/echo/encode
  --url , -u            Target URL address or the file containing the target URL
  --type default:CBC, -t default:CBC
                        Cipher Type, GCM or CBC
  --data , -d           Using this parameter will make HTTP request with POST method
  --key , -k            Specify a Shiro Key or will use dictionary brute force cracking
  --gadget , -g         Specific Ysoserial Gadget
  --command default:whoami, -c default:whoami
                        Specific Execute Command
  --proxies , -p        Specific Proxy
  --ser , -s            Specific serialize file name
  --thread , -T         Specific the number of threads

shisoserial

Most Popular

Expample

Check if shiro framework (default CBC mode)

Use proxy angent cracking the shiro key with CBC mode

Use Tomcat echo payload attack with CommonsCollectionsK1 gadget (no DNSlog used)

Mass use specified shiro key with Post method

Use serialize file send payload with multithreading

Disclaimer