ShiroAttack2 v5.1.1: A Powerful Comprehensive Exploit Tool for Shiro Deserialization Vulnerabilities
ShiroAttack2 v5.1.1 is a fast exploitation framework for the long‑standing Shiro‑550 deserialization flaw, explaining why the vulnerability persists—default AES key, immutable key across deployments, and low attack cost—while offering a rich set of GUI, CLI, and payload features.
Tool Overview
ShiroAttack2 is a rapid exploitation utility targeting the Shiro‑550 deserialization vulnerability, authored by SummerSec.
Why Shiro‑550 Remains Exploitable
The 2016 vulnerability is still viable for three practical reasons:
Default Key. Versions ≤ 1.2.4 hard‑code an AES key in CookieRememberMeManager: kPH+bIxk5D2deZiIxcaaaA==. This value has been copied into tutorials and scaffolding code for years.
Key Cannot Be Changed. The remember‑Me mechanism requires the client and server to share the same key. Once the key is embedded in configuration files, Docker images, or source repositories, all nodes must be updated simultaneously to replace it.
Low Exploitation Cost. A graphical interface allows a few clicks to obtain a shell, while the CLI can be scripted directly.
Feature Highlights
JavaFX GUI + CLI dual‑mode sharing the same attack logic.
Multiple CommonsBeanutils gadgets (1.8.3, 1.9.2, AttrCompare, ObjectToStringComparator).
Automatic AES mode switching: both CBC and GCM are tried, locking onto the successful one.
Memory‑horse injection via Filter, Servlet, Interceptor, HandlerMethod, or TomcatValve.
Echo types: TomcatEcho, SpringEcho, DFS‑AllEcho, ReverseEcho, NoEcho.
Third‑party integration of echo generator (jEG) and memory‑horse generator (jMG) with automatic fallback to Legacy.
Shiro Key replacement supporting six injection paths and automatic verification of old and new keys.
Custom request headers, cookie merging, and POST‑type probing. --json structured output for scripting and AI integration.
HTTP/HTTPS proxy support with authentication.
Key generator utility.
Tool Download
https://github.com/SummerSec/ShiroAttack2/tree/masterSigned-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
Black & White Path
We are the beacon of the cyber world, a stepping stone on the road to security.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.