当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0108653

漏洞标题：新华网某系统命令执行

相关厂商：新华网

漏洞作者： 朱元璋

提交时间：2015-04-22 16:55

修复时间：2015-06-08 17:52

公开时间：2015-06-08 17:52

漏洞类型：成功的入侵事件

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-22： 细节已通知厂商并且等待厂商处理中
2015-04-24： 厂商已经确认，细节仅向厂商公开
2015-05-04： 细节向核心白帽子及相关领域专家公开
2015-05-14： 细节向普通白帽子公开
2015-05-24： 细节向实习白帽子公开
2015-06-08： 细节向公众公开

简要描述：

感觉网站安全不是做的很好

详细说明：

http://219.153.9.73:8080/submitted/login.action

0.jpg


netstat -an
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1030 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1031 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1158 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1830 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3938 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5001 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5500 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5520 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5521 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5560 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5580 0.0.0.0:0 LISTENING
TCP 0.0.0.0:6009 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING
TCP 0.0.0.0:9073 0.0.0.0:0 LISTENING
TCP 0.0.0.0:9090 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1026 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1071 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1115 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1175 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1176 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1233 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1235 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1240 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1244 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1245 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1246 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1247 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1248 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1308 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1309 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1310 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1311 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1312 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1115 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1175 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1176 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1233 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1235 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1240 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1244 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1245 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1246 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1247 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1248 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1308 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1309 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1310 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1311 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1312 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1592 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2787 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2788 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2789 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2790 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2791 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.
ipconfig
Windows IP Configuration
Ethernet adapter 本地连接 3:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Ethernet adapter 本地连接:
Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter 本地连接 4:
Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter 本地连接 2:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 219.153.9.73
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Default Gateway . . . . . . . . . : 219.153.9.1
whoami
svctag-h3n513x\haododo
ls F:\founder_tomcat\webapps\submitted\
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

漏洞证明：

http://219.153.9.73:8080/submitted/login.action

0.jpg


netstat -an
Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1030 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1031 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1158 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1830 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3938 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5001 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5500 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5520 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5521 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5560 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5580 0.0.0.0:0 LISTENING
TCP 0.0.0.0:6009 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING
TCP 0.0.0.0:9073 0.0.0.0:0 LISTENING
TCP 0.0.0.0:9090 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1026 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1071 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1115 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1175 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1176 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1233 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1235 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1240 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1244 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1245 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1246 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1247 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1248 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1308 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1309 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1310 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1311 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1312 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1115 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1175 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1176 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1233 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1235 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1240 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1244 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1245 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1246 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1247 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1248 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1308 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1309 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1310 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1311 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1312 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:1592 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2787 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2788 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2789 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2790 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:2791 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.
ipconfig
Windows IP Configuration
Ethernet adapter 本地连接 3:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Ethernet adapter 本地连接:
Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter 本地连接 4:
Media State . . . . . . . . . . . : Media disconnected
Ethernet adapter 本地连接 2:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 219.153.9.73
Subnet Mask . . . . . . . . . . . : 255.255.255.128
Default Gateway . . . . . . . . . : 219.153.9.1
whoami
svctag-h3n513x\haododo
ls F:\founder_tomcat\webapps\submitted\
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

修复方案：

自己看着办

版权声明：转载请注明来源 朱元璋@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-04-24 17:51

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向新华网上级管理单位通报,由其后续协调网站管理单位处置.

最新状态：

暂无

漏洞评价：

评论