# ShiroAttack2
项目地址：https://github.com/SummerSec/ShiroAttack2
[](https://github.com/SummerSec/ShiroAttack2/tree/master#shiroattack2)

### 一款针对 Shiro-550 漏洞的快速漏洞利用工具

[](https://github.com/SummerSec/ShiroAttack2/tree/master#%E4%B8%80%E6%AC%BE%E9%92%88%E5%AF%B9-shiro-550-%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%BF%AB%E9%80%9F%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E5%B7%A5%E5%85%B7)

[![ShiroAttack2](https://camo.githubusercontent.com/97354b57de5bc4fe48ab83258d44c1e5a0044afe6c4c690fed8b2f0f06c87aa2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f536869726f41747461636b322d677265656e)](https://github.com/SummerSec/ShiroAttack2) [![Forks](https://camo.githubusercontent.com/affb96a2d68956f8736dd7fc05c6074f910ba4c79ce5762b7a5b4c1cf23657fa/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f666f726b732f53756d6d65725365632f536869726f41747461636b32)](https://github.com/SummerSec/ShiroAttack2) [![Release](https://camo.githubusercontent.com/ddd3c1d38c35a2581239f8cc69e7dcee25639ce53b940e14332ca486fa85625b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f53756d6d65725365632f536869726f41747461636b322e737667)](https://github.com/SummerSec/ShiroAttack2) [![Stars](https://camo.githubusercontent.com/58a217ebd0244c1753a6650ccc374d6676a0ad9df7395c05c1c6e33b2fbda4cc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f73746172732f53756d6d65725365632f536869726f41747461636b322e7376673f7374796c653d736f6369616c266c6162656c3d5374617273)](https://github.com/SummerSec/ShiroAttack2) [![Follower](https://camo.githubusercontent.com/14070082cb373be32cb103cee3b02a91c4ebc4f6d480e7b0b827221e3234a392/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f666f6c6c6f776572732f53756d6d65725365632e7376673f7374796c653d736f6369616c266c6162656c3d466f6c6c6f77)](https://github.com/SummerSec) [![Visitor](https://camo.githubusercontent.com/88f9acf4efbc426362872de7aaa891f5fac929bcf1a604e52dcc86a386852ecf/68747470733a2f2f76697369746f722d62616467652e6c616f62692e6963752f62616467653f706167655f69643d53756d6d65725365632e536869726f41747461636b32)](https://github.com/SummerSec) [![SecSummers](https://camo.githubusercontent.com/7fe0ecb3558537f63dfc8ea94731a53e1614a36c91d2a7c21def4cf88f0ee639/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f53656353756d6d6572732e737667)](https://twitter.com/SecSummers)

> 语言切换 / Language：**[中文](https://github.com/SummerSec/ShiroAttack2/blob/master/README.md)** | [English](https://github.com/SummerSec/ShiroAttack2/blob/master/README_EN.md)

完整使用说明：[docs/USAGE.md](https://github.com/SummerSec/ShiroAttack2/blob/master/docs/USAGE.md)

[![ShiroAttack2 5.x](/media/202606/3a1d3e56186d4bda8e57c04db01aad0c8121.png)](https://github.com/SummerSec/ShiroAttack2/blob/master/docs/readme.png)

* * *

## Shiro-550 为什么还能用

[](https://github.com/SummerSec/ShiroAttack2/tree/master#shiro-550-%E4%B8%BA%E4%BB%80%E4%B9%88%E8%BF%98%E8%83%BD%E7%94%A8)

2016 年的洞，到现在还能用。不是漏洞本身多高级，而是三个很现实的原因叠在一起。

**第一，默认 Key。** Shiro 1.2.4 及之前版本在 `CookieRememberMeManager` 里硬写了一个 AES Key：`kPH+bIxk5D2deZiIxcaaaA==`。十几年来的教程和脚手架代码一直在拷贝这个值。

**第二，Key 换不掉。** rememberMe 要求客户端和服务端用同一个 Key。一旦 Key 写进了配置文件、Docker 镜像、源码仓库，要替换就得所有节点一起改。

**第三，利用成本足够低。** GUI 点几下就能拿 shell，CLI 可以直接嵌进脚本。

## 功能特点

[](https://github.com/SummerSec/ShiroAttack2/tree/master#%E5%8A%9F%E8%83%BD%E7%89%B9%E7%82%B9)

*   JavaFX GUI + CLI 双模式，同一套攻击逻辑
*   多版本 CommonsBeanutils gadget（1.8.3 / 1.9.2 / AttrCompare / ObjectToStringComparator）
*   自动 AES 模式切换：CBC 和 GCM 各走一遍，哪个命中锁哪个
*   内存马注入（Filter / Servlet / Interceptor / HandlerMethod / TomcatValve）
*   回显类型：TomcatEcho / SpringEcho / DFS-AllEcho / ReverseEcho / NoEcho
*   回显生成器（jEG）和内存马生成器（jMG）第三方集成，失败自动回退 Legacy
*   Shiro Key 替换（6 条注入路径，自动验证新旧 Key）
*   自定义请求头、Cookie 合并、POST 型探测
*   `--json` 结构化输出，适合脚本化和 AI 调用
*   HTTP/HTTPS 代理（支持认证）
*   Key 生成器

Shiro漏洞利用增强版