nc: ubuntu@10-9-15-151:~$ echo stats | nc 111.233.137.90 11211 STAT pid 1340 STAT uptime 3055111422 STAT time 344865214 STAT version 1.4.4-14-g9c660c0 STAT pointer_size 64 STAT curr_connections 10 STAT total_connections 7034 STAT connection_structures 29 STAT cmd_get 901365 STAT cmd_set 38 STAT cmd_flush 0 STAT get_hits 694864 STAT get_misses 206501 STAT delete_misses 3 STAT delete_hits 7 STAT incr_misses ... telnet telnet 111.233.137.90 11211 stats (退出按ctrl+]，再输入quit) nmap
ubuntu@10-9-15-151:~$ nmap -p 11211 --script memcached-info 111.233.137.111 Starting Nmap 7.60 ( https://nmap.org ) at 2020-03-27 15:34 CST Nmap scan report for 111.233.137.111 Host is up (0.18s latency).
PORT STATE SERVICE 11211/tcp open memcache | memcached-info: | Process ID 1340 | Uptime 3055111219 seconds | Server time 1980-12-05T11:50:11 | Architecture 64 bit | Current connections 10 | Total connections 7031 | Maximum connections 1024 | TCP Port 11211 | UDP Port 11211 |_ Authentication no
Nmap done: 1 IP address (1 host up) scanned in 12.73 seconds
poc: docker -H tcp://192.168.15.5:2375 version 或者 r = requests.get(f"http://{host}:{port}/version", timeout=timeout, verify=False) if"ApiVersion"in r.text: return"docker remote api is unauthorized"
poc: r = requests.get(f"http://{host}:{port}/v2/_catalog", timeout=timeout, verify=False) if"repositories"in r.text: return"docker Registry API is unauthorized"
r = requests.get(f"http://{host}:{port}/v1/_catalog", timeout=timeout, verify=False) if"repositories"in r.text: return"docker Registry API is unauthorized"
package org.apache.shiro.mgt; publicabstractclassAbstractRememberMeManagerimplementsRememberMeManager { /** * private inner log instance. */ privatestaticfinalLoggerlog= LoggerFactory.getLogger(AbstractRememberMeManager.class); /** * The following Base64 string was generated by auto-generating an AES Key: * <pre> * AesCipherService aes = new AesCipherService(); * byte[] key = aes.generateNewKey().getEncoded(); * String base64 = Base64.encodeToString(key); * </pre> * The value of 'base64' was copied-n-pasted here: */ privatestaticfinalbyte[] DEFAULT_CIPHER_KEY_BYTES = Base64.decode("kPH+bIxk5D2deZiIxcaaaA=="); /** * Serializer to use for converting PrincipalCollection instances to/from byte arrays */ private Serializer<PrincipalCollection> serializer; /** * Cipher to use for encrypting/decrypting serialized byte arrays for added security */ private CipherService cipherService; /** * Cipher encryption key to use with the Cipher when encrypting data */ privatebyte[] encryptionCipherKey; /** * Cipher decryption key to use with the Cipher when decrypting data */ privatebyte[] decryptionCipherKey; /** * Default constructor that initializes a {@link DefaultSerializer} as the {@link #getSerializer() serializer} and * an {@link AesCipherService} as the {@link #getCipherService() cipherService}. */ publicAbstractRememberMeManager() { this.serializer = newDefaultSerializer<PrincipalCollection>(); this.cipherService = newAesCipherService(); setCipherKey(DEFAULT_CIPHER_KEY_BYTES); }
package org.apache.shiro.mgt; publicabstractclassAbstractRememberMeManagerimplementsRememberMeManager { /** * Cipher encryption key to use with the Cipher when encrypting data */ privatebyte[] encryptionCipherKey; /** * Cipher decryption key to use with the Cipher when decrypting data */ privatebyte[] decryptionCipherKey; /** * Default constructor that initializes a {@link DefaultSerializer} as the {@link #getSerializer() serializer} and * an {@link AesCipherService} as the {@link #getCipherService() cipherService}. */ publicAbstractRememberMeManager() { this.serializer = newDefaultSerializer<PrincipalCollection>(); AesCipherServicecipherService=newAesCipherService(); this.cipherService = cipherService; setCipherKey(cipherService.generateNewKey().getEncoded()); } publicvoidsetCipherKey(byte[] cipherKey) { //Since this method should only be used in symmetric ciphers //(where the enc and dec keys are the same), set it on both: setEncryptionCipherKey(cipherKey); setDecryptionCipherKey(cipherKey); }
Spring Data Commons 1.13 - 1.13.10 (Ingalls SR10) Spring Data REST 2.6 - 2.6.10 (Ingalls SR10) Spring Data Commons 2.0 to 2.0.5 (Kay SR5) Spring Data REST 3.0 - 3.0.5 (Kay SR5)
