菜单
Apache Shiro rememberMe deserialization RCE (CVE-2016-4437) with CommonsBeanutils chain. Targets Java web apps using Apache Shiro authentication framework.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Fast HTTP probing and lightweight fingerprinting using ProjectDiscovery httpx. Use for web recon with redirect-awareness and JSON output.
V5 样板 Micro-Skill：Pydantic 入参、micro_executor SDK、落盘 parsed.json、stderr S-06、stdout Agent 摘要 JSON（嵌入 raw_stdout）。
Build a basic understanding of the current project by scanning source code and available docs. Use when user asks for /init, project onboarding, quick repo familiarization, or initial architecture context.
Search the web using Baidu AI Search Engine (BDSE). Use for live information, documentation, or research topics.
Raw HTTP probing with curl. Use for custom method, headers and body requests in recon and validation.
Advanced web path scanner using multithreaded brute-force. Use for discovering hidden files, directories, and endpoints on web servers.
| name | shiro_exploit |
| description | Apache Shiro rememberMe deserialization RCE (CVE-2016-4437) with CommonsBeanutils chain. Targets Java web apps using Apache Shiro authentication framework. |
| metadata | {"openclaw":{"emoji":"💥","requires":{"bins":["python3","java"],"env":[]},"primaryEnv":null}} |
Exploits the Apache Shiro rememberMe cookie deserialization vulnerability (CVE-2016-4437) to achieve remote code execution.
Apache Shiro ≤ 1.2.4 using default AES key. CommonsBeanutils1 gadget chain is the primary payload; falls back to CC chains if BeanUtils is unavailable.
Provide target (URL of the Shiro-protected application). The skill auto-detects the Shiro fingerprint, bruteforces the AES key if needed, then delivers the payload.
| Param | Type | Required | Description |
|---|---|---|---|
| target | string | yes | URL of the Shiro-protected application |
| cmd | string | no | OS command to execute (default: id) |
| key | string | no | AES key override (base64, default: auto) |
| timeout | int | no | Timeout in seconds (default: 60) |
Detect Shiro by looking for rememberMe=deleteMe in response Set-Cookie. Use after ehole/httpx confirms Shiro fingerprint.
