Sploitus

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Redhat Jboss Enterprise Application Platform

gitee · 2021-02-02

Exploit Code

MARKDOWN2 lines
## https://sploitus.com/exploit?id=EBB12CB0-CB95-5BF3-9C1F-058B5EF0DF42
PoC exploit for CVE-2016-2183, a Padding Oracle vulnerability in Apache Shiro. The exploit targets the RCE (Remote Code Execution) vector, leveraging the Padding Oracle attack to bypass encryption and inject arbitrary data. The probable entry point is the `shiro_oracle_padding.py` script, which is typically invoked by running `python3 shiro_oracle_padding.py <target_url> <regular_cookie>`. The exploit requires a vulnerable version of Apache Shiro and a regular cookie to authenticate the request. The expected impact is RCE, allowing an attacker to execute arbitrary code on the target system.