https://souljian.cn/tags/%E5%86%85%E5%AD%98%E9%A9%AC/Recent content in 内存马 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088193/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088193/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>Nacos 攻击只在授权测试环境进行。</p> <h2 id="一nacos-攻击链">一、Nacos 攻击链 </h2><img src="https://souljian.cn/img/nacos-vuln-chain.svg" alt="Nacos 漏洞利用链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 未授权访问 → ② 添加用户 → ③ 任意文件读写 → ④ 内存马 → ⑤ RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用步骤">二、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">未授权：直接访问 /nacos/ </span></span><span class="line"><span class="cl">添加用户：POST /v1/auth/users </span></span><span class="line"><span class="cl">任意文件读写：PUT /v1/cs/configs </span></span><span class="line"><span class="cl">内存马：利用 Tomcat 执行内存 WebShell </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 Nacos 2.x+ </span></span><span class="line"><span class="cl">开启鉴权（auth.enabled=true） </span></span><span class="line"><span class="cl">不暴露公网 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>Nacos 未授权 + 任意文件读写 = RCE。防御核心是<strong>开启鉴权 + 升级到 2.x+</strong>。</p>