xk-mt/cve-2016-44371.验证CVE-2016-4437、2.解析rememberMe的文件和CBC加密的IV偏移
Decrypt rememberMe value and export corresponding class file
Instructions: After running, first enter the key or press Enter to use the default key 'kPH+bIxk5D2deZiIxcaaaA==', then enter the rememberMe value from the request packet. After parsing, you will be prompted to enter the export filename (.class will be appended automatically). If you do not want to export, simply press Enter.
Run command: python xk-mt-rememberMe解码.py
Instructions: When running, you need to provide the corresponding key and URL. The key has a default value of 'kPH+bIxk5D2deZiIxcaaaA=='. The key must be a 16-byte Base64 encoding. The verification does not execute system commands. If the value of the request header techo appears in the response header, it indicates the vulnerability exists.
Run command:
python xk-mt-单个域名单个密钥检测.py -key kPH+bIxk5D2deZiIxcaaaA== -u http://127.0.0.1:8081/login
python xk-mt-单个域名单个密钥检测.py -url http://127.0.0.1:8081/login
python xk-mt-单个域名单个密钥检测.py -u http://127.0.0.1:8081/login
Usage risk: This tool is intended for learning and technical research purposes only. Users should understand and accept the potential risks and consequences of using this tool.
Legal compliance: Users must ensure compliance with all applicable laws and regulations while using this tool. The use of this tool for any illegal activities, attacks, or privacy violations is strictly prohibited.
Disclaimer: This tool is provided "as is" without any express or implied warranties. Users are solely responsible for the results of using this tool.
Potential risks: This tool may cause system failures, data loss, or other unintended consequences. Users should test it in an appropriate environment to minimize potential risks.
Technical support: The author or maintainer does not provide any form of technical support for this tool. Users should rely on the community or other channels for assistance.
Reasonable use: Users should only use this tool for legitimate and beneficial purposes, including but not limited to security testing, research, and education.
Changes and updates: The author or maintainer reserves the right to modify or update this tool at any time. Users should regularly check relevant documentation and announcements for the latest information.
