shiro-exploit

name	shiro_exploit
description	Apache Shiro rememberMe deserialization RCE (CVE-2016-4437) with CommonsBeanutils chain. Targets Java web apps using Apache Shiro authentication framework.
metadata	{"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}}

shiro_exploit

Exploits the Apache Shiro rememberMe cookie deserialization vulnerability (CVE-2016-4437) to achieve remote code execution.

Target Framework

Apache Shiro ≤ 1.2.4 using default AES key. CommonsBeanutils1 gadget chain is the primary payload; falls back to CC chains if BeanUtils is unavailable.

Usage

Provide target (URL of the Shiro-protected application). The skill auto-detects the Shiro fingerprint, bruteforces the AES key if needed, then delivers the payload.

Parameters

Param	Type	Required	Description
target	string	yes	URL of the Shiro-protected application
cmd	string	no	OS command to execute (default: id)
key	string	no	AES key override (base64, default: auto)
timeout	int	no	Timeout in seconds (default: 60)

Notes

Detect Shiro by looking for rememberMe=deleteMe in response Set-Cookie. Use after ehole/httpx confirms Shiro fingerprint.