当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-071810

漏洞标题：上海电信某处服务配置不当导致一系列问题

相关厂商：中国电信

漏洞作者： scanf

提交时间：2014-08-11 10:15

修复时间：2014-09-25 10:16

公开时间：2014-09-25 10:16

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-08-11： 细节已通知厂商并且等待厂商处理中
2014-08-16： 厂商已经确认，细节仅向厂商公开
2014-08-26： 细节向核心白帽子及相关领域专家公开
2014-09-05： 细节向普通白帽子公开
2014-09-15： 细节向实习白帽子公开
2014-09-25： 细节向公众公开

简要描述：

可惜我不用电信的东西.呵呵.这是一个不通过的,今天心血来潮重新看了看.

详细说明：

http://116.228.171.57:8090/ismp/spportal/
http://116.228.171.57:8090/ismp/cnlportal/
http://116.228.171.57:8090/ismp/euportal/
http://116.228.171.57:8090/ismp/opportal/
Jboss 弱口令
admin/admin
然后封装个war包上传就行了

QQ截图20140810121727.png


QQ截图20140810121827.png


然后提权了

QQ截图20140810121910.png

漏洞证明：

QQ截图20140810122019.png


QQ截图20140810122048.png


QQ截图20140810122224.png


然后连上数据库看看

QQ截图20140810122752.png


还可以内网渗透哦

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2014-08-10 12:17 CST
Interesting ports on 192.168.231.1:
Not shown: 1675 closed ports
PORT    STATE    SERVICE
22/tcp  filtered ssh
23/tcp  open     telnet
80/tcp  filtered http
179/tcp filtered bgp
646/tcp filtered unknown
MAC Address: 00:E0:FC:5A:F2:E8 (Huawei Technologies CO.)
Interesting ports on 192.168.231.5:
Not shown: 1678 closed ports
PORT   STATE SERVICE
23/tcp open  telnet
80/tcp open  http
MAC Address: 00:12:80:69:6E:C0 (Cisco)
Interesting ports on 192.168.231.10:
Not shown: 1667 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
25/tcp   open  smtp
29/tcp   open  msg-icp
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
427/tcp  open  svrloc
906/tcp  open  unknown
2000/tcp open  callbook
2049/tcp open  nfs
3128/tcp open  squid-http
5800/tcp open  vnc-http
MAC Address: 00:12:79:D8:FF:26 (Hewlett Packard)
Interesting ports on 192.168.231.19:
Not shown: 1666 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   open     smtp
111/tcp  open     rpcbind
623/tcp  filtered unknown
707/tcp  open     unknown
2000/tcp open     callbook
3128/tcp open     squid-http
3306/tcp open     mysql
5800/tcp open     vnc-http
6000/tcp open     X11
6001/tcp open     X11:1
8082/tcp open     blackice-alerts
9999/tcp open     abyss
MAC Address: 00:0E:0C:08:34:36 (Intel)
Interesting ports on 192.168.231.22:
Not shown: 1671 closed ports
PORT      STATE SERVICE
111/tcp   open  rpcbind
443/tcp   open  https
915/tcp   open  unknown
2049/tcp  open  nfs
3306/tcp  open  mysql
8000/tcp  open  http-alt
8009/tcp  open  ajp13
8080/tcp  open  http-proxy
10005/tcp open  stel
MAC Address: 00:0C:29:52:13:3D (VMware)
Interesting ports on 192.168.231.23:
Not shown: 1670 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
111/tcp   open  rpcbind
443/tcp   open  https
915/tcp   open  unknown
2049/tcp  open  nfs
3306/tcp  open  mysql
8000/tcp  open  http-alt
8009/tcp  open  ajp13
8080/tcp  open  http-proxy
10005/tcp open  stel
MAC Address: 00:0C:29:52:13:3D (VMware)
Interesting ports on 192.168.231.24:
Not shown: 1671 closed ports
PORT      STATE SERVICE
111/tcp   open  rpcbind
443/tcp   open  https
915/tcp   open  unknown
2049/tcp  open  nfs
3306/tcp  open  mysql
8000/tcp  open  http-alt
8009/tcp  open  ajp13
8080/tcp  open  http-proxy
10005/tcp open  stel
MAC Address: 00:0C:29:52:13:3D (VMware)
Interesting ports on 192.168.231.25:
Not shown: 1671 closed ports
PORT      STATE SERVICE
111/tcp   open  rpcbind
443/tcp   open  https
915/tcp   open  unknown
2049/tcp  open  nfs
3306/tcp  open  mysql
8000/tcp  open  http-alt
8009/tcp  open  ajp13
8080/tcp  open  http-proxy
10005/tcp open  stel
MAC Address: 00:0C:29:52:13:3D (VMware)
Interesting ports on winter (192.168.231.32):
Not shown: 1675 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
111/tcp  open  rpcbind
609/tcp  open  npmp-trap
1521/tcp open  oracle
Interesting ports on 192.168.231.34:
Not shown: 1671 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
111/tcp  open  rpcbind
512/tcp  open  exec
513/tcp  open  login
514/tcp  open  shell
7070/tcp open  realserver
8009/tcp open  ajp13
MAC Address: 00:1F:29:E7:80:90 (Unknown)
Interesting ports on 192.168.231.40:
Not shown: 1676 closed ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
902/tcp  open  iss-realsecure-sensor
8000/tcp open  http-alt
MAC Address: 00:16:35:00:D9:E1 (Hewlett Packard)
Interesting ports on 192.168.231.41:
Not shown: 1670 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
111/tcp   open  rpcbind
915/tcp   open  unknown
2049/tcp  open  nfs
3306/tcp  open  mysql
8000/tcp  open  http-alt
8009/tcp  open  ajp13
8080/tcp  open  http-proxy
10005/tcp open  stel
MAC Address: 00:0C:29:52:13:3D (VMware)
Interesting ports on 192.168.231.58:
Not shown: 1671 closed ports
PORT      STATE SERVICE
22/tcp    open  ssh
23/tcp    open  telnet
111/tcp   open  rpcbind
2020/tcp  open  xinupageserver
2023/tcp  open  xinuexpansion3
12000/tcp open  cce4x
27000/tcp open  flexlm0
32774/tcp open  sometimes-rpc11
32775/tcp open  sometimes-rpc13
MAC Address: 00:17:08:57:77:18 (Hewlett Packard)
Nmap finished: 255 IP addresses (13 hosts up) scanned in 46.056 seconds


就不深入了.

修复方案：

电信业务线长，得加强对运维的要求,
弱口令层出不穷,也是能根本的解决的,教育运维叔叔

版权声明：转载请注明来源 scanf@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：14

确认时间：2014-08-16 08:32

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2014-08-11 10:27 | 浮萍 ( 普通白帽子 | Rank:555 漏洞数:118 | 默默潜水)

    哇 心血来潮 大姨妈

  2. 2014-08-11 10:44 | 金枪银矛小霸王 ( 普通白帽子 | Rank:103 漏洞数:25 | 不会挖洞洞的猿猿不是好学生)

    就是都不知道哪来的人品