| name | shiro_exploit |
| description | Apache Shiro rememberMe deserialization RCE (CVE-2016-4437) with CommonsBeanutils chain. Targets Java web apps using Apache Shiro authentication framework. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}} |
shiro_exploit
Exploits the Apache Shiro rememberMe cookie deserialization vulnerability (CVE-2016-4437) to achieve remote code execution.
Target Framework
Apache Shiro ≤ 1.2.4 using default AES key. CommonsBeanutils1 gadget chain is the primary payload; falls back to CC chains if BeanUtils is unavailable.
Usage
Provide target (URL of the Shiro-protected application). The skill auto-detects the Shiro fingerprint, bruteforces the AES key if needed, then delivers the payload.
Parameters
| Param | Type | Required | Description |
|---|
| target | string | yes | URL of the Shiro-protected application |
| cmd | string | no | OS command to execute (default: id) |
| key | string | no | AES key override (base64, default: auto) |
| timeout | int | no | Timeout in seconds (default: 60) |
Notes
Detect Shiro by looking for rememberMe=deleteMe in response Set-Cookie. Use after ehole/httpx confirms Shiro fingerprint.
