云安全中心API应急漏洞扫描实战

新钛云服已累计为您分享643篇技术干货

云安全中心应急漏洞扫描

云安全中心是一个实时识别、分析、预警安全威胁的统一安全管理系统，通过防勒索、防病毒、防篡改、合规检查等安全能力，实现威胁检测、告警响应、攻击溯源的自动化安全运营闭环，保护云上资产和本地服务器安全，并满足监管合规要求。

前提条件配置

①子账户生成阿里云的AKSK信息，授权云安全中心权限

②python环境配置

安装依赖

yum -y install zlib-devel bzip2-devel openssl-devel ncurses-devel gdbm-devel sqlite-devel readline-devel tk-devel gcc make libffi-devel gcc-c++ libffi zlib zlib-dev libssl-dev db4-devel libpcap-devel xz-devel

3 4 5

下载python3.10.4

wget -c https://www.python.org/ftp/python/3.10.4/Python-3.10.4.tgz

7 8

解压python3.10.4

tar -zxvf Python-3.10.4.tgz

1011cd

Python-3.10.4/

./configure --with-ssl

make && make install

1415

备份python文件

mv /usr/bin/python /usr/bin/python.bak

1718#建立python3的软链接19

ln -s /usr/

local

/bin/python3 /usr/bin/python

2021which

pip3

22#yum执行异常解决23

vi /usr/libexec/urlgrabber-ext-down

24#! /usr/bin/python22526

vi /usr/bin/yum

27#!/usr/bin/python2282930

安装模块

pip3 install --upgrade pip

pip3 install alibabacloud_sas20181203==1.1.13

pip install alibabacloud_tea_console

3435

如果在import ssl调式报错ImportError: cannot import name

'OPENSSL_VERSION_NUMBER'

from

'_ssl'

(unknown location)解决办法如下

3637#下载安装openssl38

wget -c https://www.openssl.org/

source

/openssl-1.1.1n.tar.gz

tar -zxvf openssl-1.1.1n.tar.gz

40cd

openssl-1.1.1n

./config --prefix=/usr/

local

/openssl

make && make instal

mv /usr/bin/openssl /usr/bin/openssl.bak

ln -sf /usr/

local

/openssl/bin/openssl /usr/bin/openssl

45echo"/usr/local/openssl/lib"

>> /etc/ld.so.conf

4647

ldconfig -v

4849#查询openssl版本50

openssl version

5152

vim /root/Python-3.10.4/Modules/Setup

211 OPENSSL=/usr/

local

/openssl

212 _ssl _ssl.c \

213 -I$(OPENSSL)/include -L$(OPENSSL)/lib \

214 -lssl -lcrypto

575859

最后在执行下python3.10.4安装

60cd

Python-3.10.4/

./configure

make && make install

一、扫描获取特定应急漏洞的名称信息

如扫描fastjson <= 1.2.80 反序列化任意代码执行漏洞

API文档 https://help.aliyun.com/document_detail/421691.html

Lang:zh

RiskStatus:y

ScanType:python

CheckType:fastjson <= 1.2.80 反序列化任意代码执行漏洞

VulName:

{

2"TotalCount"

3"RequestId"

"A79C0E69-CE10-5688-8D01-7322BD3715C8"

4"PageSize"

5"CurrentPage"

6"GroupedVulItems"

: [

{

8"Status"

9"PendingCount"

116

10"Type"

"python"

11"Description"

"fastjson已使用黑白名单用于防御反序列化漏洞，经研究该利用在特定条件下可绕过默认autoType关闭限制，攻击远程服务器，风险影响较大。建议fastjson用户尽快采取安全措施保障系统安全。\n\n特定依赖存在下影响 ≤1.2.80。"

12"CheckType"

13"AliasName"

"fastjson <= 1.2.80 反序列化任意代码执行漏洞【原理扫描】"

14"GmtLastCheck"

1653471386000

15"GmtPublish"

1653273837000

16"Name"

"emg:SCA:AVD-2022-1243027"17

}

]

}

得到特定应急漏洞名称信息为emg:SCA:AVD-2022-1243027

pip install alibabacloud_sas20181203==1.1.13

pip install alibabacloud_tea_console

1# -*- coding: utf-8 -*- 2# This file is auto-generated, don't edit it. Thanks. 3import

sys

4 5from

typing

import

List

6from

Tea.core

import

TeaCore

7 8from

alibabacloud_sas20181203.client

import

Client

Sas20181203Client

9from

alibabacloud_tea_openapi

import

models

open_api_models

10from

alibabacloud_sas20181203

import

models

sas_20181203_models

11from

alibabacloud_tea_util

import

models

util_models

12from

alibabacloud_tea_console.client

import

Client

ConsoleClient

13from

alibabacloud_tea_util.client

import

Client

UtilClient

141516classSample:17def__init__(self):18pass1920

@staticmethod

21defcreate_client

(

access_key_id: str,

access_key_secret: str,

)

-> Sas20181203Client:25

"""

使用AK&SK初始化账号Client

@param access_key_id:

@param access_key_secret:

@return: Client

@throws Exception

"""

config = open_api_models.Config(

33# 您的AccessKey ID,34

access_key_id=

'LTAI5t'

35# 您的AccessKey Secret,36

access_key_secret=

'dSr'37

)

38# 访问的域名39

config.endpoint =

f'tds.aliyuncs.com'40return

Sas20181203Client(config)

4142

@staticmethod

43defmain

(

args: List[str],

)

-> None:46

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

describe_emg_vul_item_request = sas_20181203_models.DescribeEmgVulItemRequest(

lang=

'zh'

risk_status=

'y'

scan_type=

'python'

vul_name=

'fastjson <= 1.2.80 反序列化任意代码执行漏洞'52

)

runtime = util_models.RuntimeOptions()

resp = client.describe_emg_vul_item_with_options(describe_emg_vul_item_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

5657

@staticmethod

58asyncdefmain_async

(

args: List[str],

)

-> None:61

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

describe_emg_vul_item_request = sas_20181203_models.DescribeEmgVulItemRequest(

lang=

'zh'

risk_status=

'y'

scan_type=

'python'

vul_name=

'fastjson <= 1.2.80 反序列化任意代码执行漏洞'67

)

runtime = util_models.RuntimeOptions()

resp =

await

client.describe_emg_vul_item_with_options_async(describe_emg_vul_item_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

717273if

__name__ ==

'__main__'

Sample.main(sys.argv[

:])

二、根据特定的应急漏洞执行扫描任务

Lang:zh

Name:emg:SCA:AVD-2022-1243027

UserAgreement:yes

{

2"RequestId"

"08744049-2F38-54BF-A7E7-529B5226AC9E"3

}

pip install alibabacloud_sas20181203==1.1.13

# -*- coding: utf

-8

-*-

# This file is auto-generated, don't edit it. Thanks.

import sys

4 5

from typing import List

from Tea.core import TeaCore

7 8

from alibabacloud_sas

20181203

.client import Client as Sas

20181203

Client

from alibabacloud_tea_openapi import models as open_api_models

from alibabacloud_sas

20181203

import models as sas_

20181203

_models

from alibabacloud_tea_util import models as util_models

from alibabacloud_tea_console.client import Client as ConsoleClient

from alibabacloud_tea_util.client import Client as UtilClient

141516

class Sample:

def __init__(self):

pass

1920

@staticmethod

def create_client(

access_key_id: str,

access_key_secret: str,

) -> Sas

20181203

Client:

25""

使用AK&SK初始化账号Client

@param access_key_id:

@param access_key_secret:

@return: Client

@throws Exception

""32

config = open_api_models.Config(

# 您的AccessKey ID,

access_key_id='LTAI

t',

# 您的AccessKey Secret,

access_key_secret='dS'

)

# 访问的域名

config.endpoint = f'tds.aliyuncs.com'

return Sas

20181203

Client(config)

4142

@staticmethod

def main(

args: List[str],

) -> None:

client = Sample.create_client('ACCESS_KEY_ID', 'ACCESS_KEY_SECRET')

modify_emg_vul_submit_request = sas_

20181203

_models.ModifyEmgVulSubmitRequest(

lang='zh',

name='emg:SCA:AVD

-2022-1243027

user_agreement='yes'

)

runtime = util_models.RuntimeOptions()

resp = client.modify_emg_vul_submit_with_options(modify_emg_vul_submit_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

5556

@staticmethod

async def main_async(

args: List[str],

) -> None:

client = Sample.create_client('ACCESS_KEY_ID', 'ACCESS_KEY_SECRET')

modify_emg_vul_submit_request = sas_

20181203

_models.ModifyEmgVulSubmitRequest(

lang='zh',

name='emg:SCA:AVD

-2022-1243027

user_agreement='yes'

)

runtime = util_models.RuntimeOptions()

resp = await client.modify_emg_vul_submit_with_options_async(modify_emg_vul_submit_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

697071

if __name__ == '__main__':

Sample.main(sys.argv[

:])

执行脚本发现阿里云的云安全中心应急漏洞fastjson <= 1.2.80 反序列化任意代码执行漏洞开始执行扫描任务计划

三、应急漏洞全部扫描

Types:"emg"

Uuids:

cve：Linux软件漏洞

sys：Windows系统漏洞

cms：Web-CMS漏洞

app：应用漏洞

emg：应急漏洞

image：容器镜像漏洞

pip install alibabacloud_sas20181203==1.1.13

1# -*- coding: utf-8 -*- 2# This file is auto-generated, don't edit it. Thanks. 3import

sys

4 5from

typing

import

List

6from

Tea.core

import

TeaCore

7 8from

alibabacloud_sas20181203.client

import

Client

Sas20181203Client

9from

alibabacloud_tea_openapi

import

models

open_api_models

10from

alibabacloud_sas20181203

import

models

sas_20181203_models

11from

alibabacloud_tea_util

import

models

util_models

12from

alibabacloud_tea_console.client

import

Client

ConsoleClient

13from

alibabacloud_tea_util.client

import

Client

UtilClient

141516classSample:17def__init__(self):18pass1920

@staticmethod

21defcreate_client

(

access_key_id: str,

access_key_secret: str,

)

-> Sas20181203Client:25

"""

使用AK&SK初始化账号Client

@param access_key_id:

@param access_key_secret:

@return: Client

@throws Exception

"""

config = open_api_models.Config(

33# 您的AccessKey ID,34

access_key_id=

'LTAI5t'

35# 您的AccessKey Secret,36

access_key_secret=

'dSr'37

)

38# 访问的域名39

config.endpoint =

f'tds.aliyuncs.com'40return

Sas20181203Client(config)

4142

@staticmethod

43defmain

(

args: List[str],

)

-> None:46

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

modify_start_vul_scan_request = sas_20181203_models.ModifyStartVulScanRequest(

types=

'"emg"'49

)

runtime = util_models.RuntimeOptions()

resp = client.modify_start_vul_scan_with_options(modify_start_vul_scan_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

5354

@staticmethod

55asyncdefmain_async

(

args: List[str],

)

-> None:58

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

modify_start_vul_scan_request = sas_20181203_models.ModifyStartVulScanRequest(

types=

'"emg"'61

)

runtime = util_models.RuntimeOptions()

resp =

await

client.modify_start_vul_scan_with_options_async(modify_start_vul_scan_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

656667if

__name__ ==

'__main__'

Sample.main(sys.argv[

:])

执行完脚本后应急漏洞服务全部开始扫描计划任务

四、导出应急漏洞列表信息

API文档信息 ExportVul - 导出漏洞列表 (aliyun.com)

Lang:zh

Type:emg

Uuids:

AliasName:fastjson <= 1.2.80 反序列化任意代码执行漏洞

Necessity:asap

Dealed:n

1# -*- coding: utf-8 -*- 2# This file is auto-generated, don't edit it. Thanks. 3import

sys

4 5from

typing

import

List

6from

Tea.core

import

TeaCore

7 8from

alibabacloud_sas20181203.client

import

Client

SasClient

9from

alibabacloud_tea_openapi

import

models

open_api_models

10from

alibabacloud_darabonba_env.client

import

Client

EnvClient

11from

alibabacloud_sas20181203

import

models

sas_models

12from

alibabacloud_tea_console.client

import

Client

ConsoleClient

13from

alibabacloud_tea_util.client

import

Client

UtilClient

141516classSample:17def__init__(self):18pass1920

@staticmethod

21defcreate_client

(

access_key_id: str,

access_key_secret: str,

)

-> SasClient:25

"""

使用AK&SK初始化账号Client

"""

config = open_api_models.Config()

29# 您的AccessKey ID30

config.access_key_id =

'LTAI5t'31# 您的AccessKey Secret32

config.access_key_secret =

'dSrH3z'33

config.endpoint =

'tds.aliyuncs.com'34return

SasClient(config)

3536

@staticmethod

37defmain

(

args: List[str],

)

-> None:40

client = Sample.create_client(EnvClient.get_env(

'ACCESS_KEY_ID'

), EnvClient.get_env(

'ACCESS_KEY_SECRET'

))

export_request = sas_models.ExportVulRequest(

lang=

'zh'

type=

'emg'

alias_name=

'fastjson <= 1.2.80 反序列化任意代码执行漏洞'

necessity=

'asap'

dealed=

'n'47

)

export_response = client.export_vul(export_request)

ConsoleClient.log(

f'response is {UtilClient.to_jsonstring(TeaCore.to_map(export_response.body))}'

)

5051

@staticmethod

52asyncdefmain_async

(

args: List[str],

)

-> None:55

client = Sample.create_client(EnvClient.get_env(

'ACCESS_KEY_ID'

), EnvClient.get_env(

'ACCESS_KEY_SECRET'

))

export_request = sas_models.ExportVulRequest(

lang=

'zh'

type=

'emg'

alias_name=

'fastjson <= 1.2.80 反序列化任意代码执行漏洞'

necessity=

'asap'

dealed=

'n'62

)

export_response =

await

client.export_vul_async(export_request)

ConsoleClient.log(

f'response is {UtilClient.to_jsonstring(TeaCore.to_map(export_response.body))}'

)

656667if

__name__ ==

'__main__'

Sample.main(sys.argv[

:])

得到值为

[LOG] response is {

"FileName"

"emg_20220526"

"Id"

102889

"RequestId"

"A15E37DA-10C8-542D-8D59-CCCB5E6837E4"

}

在执行脚本的时候可以通过过滤id号得到漏洞导出任务的ID信息，最后得到值为102889

python3 exportall.py | grep \

"Id\" | awk -F\: '{print

}' | awk -F\, '{print

通过ExportId的102889获取文件下载

1# -*- coding: utf-8 -*- 2# This file is auto-generated, don't edit it. Thanks. 3import

sys

4 5from

typing

import

List

6from

Tea.core

import

TeaCore

7 8from

alibabacloud_sas20181203.client

import

Client

SasClient

9from

alibabacloud_tea_openapi

import

models

open_api_models

10from

alibabacloud_darabonba_env.client

import

Client

EnvClient

11from

alibabacloud_sas20181203

import

models

sas_models

12from

alibabacloud_tea_console.client

import

Client

ConsoleClient

13from

alibabacloud_tea_util.client

import

Client

UtilClient

141516classSample:17def__init__(self):18pass1920

@staticmethod

21defcreate_client

(

access_key_id: str,

access_key_secret: str,

)

-> SasClient:25

"""

使用AK&SK初始化账号Client

"""

config = open_api_models.Config()

29# 您的AccessKey ID30

config.access_key_id =

'LTAI'31# 您的AccessKey Secret32

config.access_key_secret =

'dSrH'33

config.endpoint =

'tds.aliyuncs.com'34return

SasClient(config)

3536

@staticmethod

37defmain

(

args: List[str],

)

-> None:40

client = Sample.create_client(EnvClient.get_env(

'ACCESS_KEY_ID'

), EnvClient.get_env(

'ACCESS_KEY_SECRET'

))

export_request = sas_models.ExportVulRequest(

type=

'cve'43

)

export_response = client.export_vul(export_request)

body = export_response.body

export_info_id = body.id

vul_export_info_request = sas_models.DescribeVulExportInfoRequest(

export_id=

10288949

)

info_detail_response = client.describe_vul_export_info(vul_export_info_request)

ConsoleClient.log(

f'response is {UtilClient.to_jsonstring(TeaCore.to_map(info_detail_response.body))}'

)

5253

@staticmethod

54asyncdefmain_async

(

args: List[str],

)

-> None:57

client = Sample.create_client(EnvClient.get_env(

'ACCESS_KEY_ID'

), EnvClient.get_env(

'ACCESS_KEY_SECRET'

))

export_request = sas_models.ExportVulRequest(

type=

'cve'60

)

export_response =

await

client.export_vul_async(export_request)

body = export_response.body

export_info_id = body.id

vul_export_info_request = sas_models.DescribeVulExportInfoRequest(

export_id=

10288966

)

info_detail_response =

await

client.describe_vul_export_info_async(vul_export_info_request)

ConsoleClient.log(

f'response is {UtilClient.to_jsonstring(TeaCore.to_map(info_detail_response.body))}'

)

697071if

__name__ ==

'__main__'

Sample.main(sys.argv[

:])

执行脚本得到附件的下载链接

python exportfile.py | awk -F\

"Link\": '{print $2}' | awk -F\, '{print $1}' | xargs wget -O "

emg_$(date +%Y%m%d).zip

可以把zip文件解压后上传到oss存储中，通过脚本钉钉推送到指定群通知或者邮件推送指定的人

钉钉推送如下

wget https://gosspublic.alicdn.com/ossutil/1.7.9/ossutil64

chmod 755 ossutil64

4 5 6

./ossutil64 config

./ossutil64 ls oss://examplebucket -c /home/config

8 910

vim vulnerabilityDingtack.sh

#!/bin/bash

1213

UPLOAD_TIME=$(date "+%Y%m%d")

curl 'https://oapi.dingtalk.com/robot/send?access_token=88c98f36028d0564c' \

-H 'Content-Type: application/json' \

-d '{

"msgtype": "link",

"link": {

"text":"应急安全漏洞 \n",

"title": "应急安全漏洞报告",

"picUrl": "https://vulnerability.oss-cn-shanghai.aliyuncs.com/vulnerability/vulnerability.png",

"messageUrl": "https://vulnerability.oss-cn-shanghai.aliyuncs.com/vulnerability/emg_'${UPLOAD_TIME}'.xlsx"

}

2526

echo "---------上传到OSS--------------------"

ALI_OSS_ENDPOINT="oss-cn-shanghai.aliyuncs.com"

ALI_OSS_AK="LTAI5"

ALI_OSS_SK="dSrH3z"

WORKSPACE=/opt/kingen

3132

#打开oss命令文件夹

cd ${WORKSPACE}/

#配置oss

./ossutil64 config -e ${ALI_OSS_ENDPOINT} -i ${ALI_OSS_AK} -k ${ALI_OSS_SK}

unzip emg_${UPLOAD_TIME}.zip

#上传apk到oss

./ossutil64 cp "./emg_${UPLOAD_TIME}.xlsx" "oss://backups/vulnerability/"

来个开胃小菜

阿里云CDN刷新目录脚本(刷新之前更换AKSK秘钥,替换object_path刷新的网站URL地址)

pip install alibabacloud_cdn20180510==1.0.11

1# -*- coding: utf-8 -*- 2# This file is auto-generated, don't edit it. Thanks. 3import

sys

4 5from

typing

import

List

6from

Tea.core

import

TeaCore

7 8from

alibabacloud_cdn20180510.client

import

Client

Cdn20180510Client

9from

alibabacloud_tea_openapi

import

models

open_api_models

10from

alibabacloud_cdn20180510

import

models

cdn_20180510_models

11from

alibabacloud_tea_util

import

models

util_models

12from

alibabacloud_tea_console.client

import

Client

ConsoleClient

13from

alibabacloud_tea_util.client

import

Client

UtilClient

141516classSample:17def__init__(self):18pass1920

@staticmethod

21defcreate_client

(

access_key_id: str,

access_key_secret: str,

)

-> Cdn20180510Client:25

"""

使用AK&SK初始化账号Client

@param access_key_id:

@param access_key_secret:

@return: Client

@throws Exception

"""

config = open_api_models.Config(

33# 您的AccessKey ID,34

access_key_id=access_key_id,

35# 您的AccessKey Secret,36

access_key_secret=access_key_secret

)

38# 访问的域名39

config.endpoint =

f'cdn.aliyuncs.com'40return

Cdn20180510Client(config)

4142

@staticmethod

43defmain

(

args: List[str],

)

-> None:46

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

refresh_object_caches_request = cdn_20180510_models.RefreshObjectCachesRequest(

object_path=

'https://uat.abc.com/'

object_type=

'Directory'50

)

runtime = util_models.RuntimeOptions()

resp = client.refresh_object_caches_with_options(refresh_object_caches_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

5455

@staticmethod

56asyncdefmain_async

(

args: List[str],

)

-> None:59

client = Sample.create_client(

'ACCESS_KEY_ID'

'ACCESS_KEY_SECRET'

)

refresh_object_caches_request = cdn_20180510_models.RefreshObjectCachesRequest(

object_path=

'https://club-admin-7788-uat.apta.com.hk/'

object_type=

'Directory'63

)

runtime = util_models.RuntimeOptions()

resp =

await

client.refresh_object_caches_with_options_async(refresh_object_caches_request, runtime)

ConsoleClient.log(UtilClient.to_jsonstring(TeaCore.to_map(resp)))

676869if

__name__ ==

'__main__'

Sample.main(sys.argv[

:])

成功给https://uat.abc.com网站目录刷新。

了解新钛云服

新钛云服荣膺第四届FMCG零售消费品行业CIO年会「年度数字化服务最值得信赖品牌奖」

新钛云服三周岁，公司月营收超600万元，定下百年新钛的发展目标

当IPFS遇见云服务|新钛云服与冰河分布式实验室达成战略协议

新钛云服正式获批工信部ISP/IDC(含互联网资源协作)牌照

深耕专业，矗立鳌头，新钛云服获千万Pre-A轮融资

新钛云服，打造最专业的Cloud MSP+，做企业业务和云之间的桥梁

新钛云服一周年，完成两轮融资，服务五十多家客户

上海某仓储物流电子商务公司混合云解决方案

往期技术干货

Kubernetes扩容到7,500节点的历程

低代码开发，全民开发，淘汰职业程序员！

国内主流公有云VPC使用对比及总结

万字长文：云架构设计原则|附PDF下载

刚刚，OpenStack 第 19 个版本来了，附28项特性详细解读！

Ceph OSD故障排除|万字经验总结

七个用于Docker和Kubernetes防护的安全工具

运维人的终身成长，从清单管理开始|万字长文！

OpenStack与ZStack深度对比：架构、部署、计算存储与网络、运维监控等

什么是云原生？

IT混合云战略：是什么、为什么，如何构建？

点👇分享

戳👇在看

继续阅读

阅读原文

关键词

系统

代码

脚本

实战

域名