当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0111432

漏洞标题：国家某安全培训平台getshell&服务器信息&多处数据库&ftp账密可查任何人证件以及身份资料

相关厂商：安全培训平台

漏洞作者： 路人甲

提交时间：2015-05-01 09:25

修复时间：2015-06-19 17:00

公开时间：2015-06-19 17:00

漏洞类型：命令执行

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-01： 细节已通知厂商并且等待厂商处理中
2015-05-05： 厂商已经确认，细节仅向厂商公开
2015-05-15： 细节向核心白帽子及相关领域专家公开
2015-05-25： 细节向普通白帽子公开
2015-06-04： 细节向实习白帽子公开
2015-06-19： 细节向公众公开

简要描述：

国家某安全培训平台getshell&服务器信息&多处数据库可查任何人证件以及身份资料

详细说明：

网站:中国食品安全培训网
描述:站点存在Struts2命令执行漏洞可获取webshell权限
0x01:getshell
地址：http://182.18.30.163/zhengshuchaxun.action

1.png


活动连接
  协议  本地地址          外部地址        状态
  TCP    0.0.0.0:21             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:80             0.0.0.0:0              LISTENING
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:554            0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1158           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:1521           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3306           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:3938           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5520           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5560           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:5580           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:8009           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:8080           0.0.0.0:0              LISTENING
  TCP    0.0.0.0:30001          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49159          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49227          0.0.0.0:0              LISTENING
  TCP    0.0.0.0:49228          0.0.0.0:0              LISTENING
  TCP    127.0.0.1:1521         127.0.0.1:60977        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:60986        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:60987        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:60992        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:61502        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:61595        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:61610        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:61616        ESTABLISHED
  TCP    127.0.0.1:1521         127.0.0.1:61621        ESTABLISHED
  TCP    127.0.0.1:8005         0.0.0.0:0              LISTENING
  TCP    127.0.0.1:43958        0.0.0.0:0              LISTENING
  TCP    127.0.0.1:49156        0.0.0.0:0              LISTENING
  TCP    127.0.0.1:60977        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:60986        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:60987        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:60992        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:61502        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:61582        127.0.0.1:1521         TIME_WAIT
  TCP    127.0.0.1:61590        127.0.0.1:1521         TIME_WAIT
  TCP    127.0.0.1:61595        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:61610        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:61616        127.0.0.1:1521         ESTABLISHED
  TCP    127.0.0.1:61621        127.0.0.1:1521         ESTABLISHED
  TCP    182.18.30.163:80       113.142.157.46:16878   ESTABLISHED
  TCP    182.18.30.163:139      0.0.0.0:0              LISTENING
  TCP    182.18.30.163:1521     182.18.30.163:49160    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49166    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49167    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49169    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49171    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49209    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:49210    ESTABLISHED
  TCP    182.18.30.163:1521     182.18.30.163:61519    ESTABLISHED
  TCP    182.18.30.163:3938     182.18.30.163:61624    TIME_WAIT
  TCP    182.18.30.163:49160    182.18.30.163:1521     ESTABLISHED
  TCP    182.18.30.163:49166    182.18.30.163:1521     ESTABLISHED
  TCP    182.18.30.163:49167    182.18.30.163:1521     ESTABLISHED

漏洞证明：

0x02:数据库&配置

##########sqlserver2005 configs
driverClass=net.sourceforge.jtds.jdbc.Driver
maxPoolSize=100
minPoolSize=2
acquireIncrement=2
user=sa
password=1
jdbcUrl=jdbc:jtds:sqlserver://127.0.0.1:1431;DatabaseName=e_gdgat;SelectMethod\=cursor
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
#jdbcUrl=jdbc\:jtds\:sqlserver\://210.51.174.182\:1431;DatabaseName\=elearning_;SelectMethod\=cursor
##########mysql configs
#driverClass=com.mysql.jdbc.Driver
#maxPoolSize=100
#minPoolSize=2
#acquireIncrement=2
#user=root
#password=1
#jdbcUrl=jdbc\:mysql\://localhost\:3306/elearning_qqhr?autoreconnect\=true
##########openmeetings
openmeetings.jdbcUrl=jdbc\:mysql\://localhost\:3306/openmeetings?autoreconnect\=true
openmeetings.user =root
openmeetings.password =1


二、

##########mysql configs
driverClass=oracle.jdbc.driver.OracleDriver
maxPoolSize=100
minPoolSize=2
initialpoolsize=10
acquireIncrement=2
user=wsj20140712
password=wsj20140712
jdbcUrl=jdbc:oracle:thin:@localhost:1521:orcl
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
##########openmeetings
openmeetings.driverClass=com.mysql.jdbc.Driver
openmeetings.jdbcUrl=jdbc:mysql://192.168.9.200:3306/openmeetings_jnt?autoreconnect=true
openmeetings.user =root
openmeetings.password =1


三、

##########mysql configs
driverClass=com.mysql.jdbc.Driver
maxPoolSize=100
minPoolSize=2
acquireIncrement=2
user=root
password=1
jdbcUrl=jdbc:mysql://localhost:3306/e_wx?autoreconnect=true
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
##########openmeetings
openmeetings.jdbcUrl=jdbc\:mysql\://localhost\:3306/openmeetings?autoreconnect\=true
openmeetings.user =root
openmeetings.password =1


四、

system_jtm_open_jtm=false
system_jtm_my_evaluation_url=http\://182.18.31.226\:8081/kaihangtest/User_login.aspx
system_jtm_report_eval_url = http\://182.18.31.226\:8081/kaihangtest/ReportEval.aspx
system_jtm_peoplePost_url=http\://182.18.31.226\:8081/kaihanghrm/manage/PDjlcx2.aspx
system_jtm_my_report_url=http\://182.18.31.226\:8081/kaihanghrm/manage/ReportPD/reportbmself.aspx
system_jtm_courses_aynchronization_url=http\://182.18.31.226\:8081/kaihanghrm/Manage/courseinfo.aspx
system_jtm_my_cepingCourses_url=http\://182.18.31.226\:8081/kaihanghrm/Manage/getpushclass.aspx
#
#Wed Apr 22 16:30:05 CST 2015
product_fabu_can_alter=true
system.conf.isexam=false
system.conf.msg.password=zahj
publish_option=0
sysconf.ktxzEditorHtml=
sysconf.jsbySwf=elstuffs/1515/1519.swf
sysconf.pxEditorHtml=
study.class.need.sh=false
system.conf.register=1
learning.dl.dl=0.1
stuff_op=false
system_release_question_need_sh=false
system.conf.allowMultipleSign=true
sysconf.sd=1
sysconf.kdhxzSwf=elstuffs/1515/1519.swf
learning.ks.cj=0.0
system.conf.userimp.ischeck=true
system.conf.email.smtp=smtp.qq.com
forum.need.sh=false
sysconf.tyxtEditorHtml=
sysconf.kdhxzEditorHtml=
system.conf.msg.username=zahj
model_working=2
stuff_url_local=1
system.conf.login.addip=0
public_end=elstuffs/1273/1370.wma
knowledge.need.sh=false
learning.xs.xs=3.0
system.conf.email.unames=1105157153@qq.com
sysconf.pxSwf=elstuffs/1515/1519.swf
sysconf.jsbyEditorHtml=
system_conf_login_failure_max=0
system_conf_login_max=0
sysconf.wjm=1
system.conf.registerinfo.isall=true
openmeetings.url=http\://localhostopenmeetings.admin.user\=admin
system.conf.email.pwds=hlWzjC@610903
sysconf.intelligentTutoringPoints=60
system.conf.ctype.8=4
system.conf.ctype.7=5
learning.xz.xz=0.0
system.conf.ctype.6=4
system.conf.ctype.5=2
system.conf.ctype.4=3
system.conf.database.type=oracle
system.conf.ctype.3=2
system.conf.ctype.2=1
system.conf.ctype.1=1
register.need.sh=false
system.conf.is_enquiry_in_table=false
title_rule=1
learning.bxz.bxz=0.0
sysconf.similarity=60
system.conf.office.home=C\:/Program Files (x86)/OpenOffice.org 3
system_answer_question_need_sh=true
stuff_url=http\://www.cfeu.org/
sysconf.tzSwf=elstuffs/1515/1519.swf
learning.lx.lx=0.0
system.mac_need=false
learning.ft.ft=0.5
line_training_course_add_need_sh=true
learning.btj.btj=0.0
study.course.need.sh=false
system.conf.yzcode.open=0
openmeetings.admin.pwd=admin
sysconf.mac_need=false
system.conf.pdf2swf.path=C\:/Program Files (x86)/SWFTools/pdf2swf.exe
catalogue_place=/html
openmeetings.admin.user=\u65E0\u8BB0\u5F55
learning.sc.sc=5.0
product_need_sh=true
learning.fy.fy=0.1
duandian_need_xc=false
stuff_isftopic=false
shouye.url=\u65E0\u8BB0\u5F55
coursemake.need.sh=false
shipin_need_zh=false
product_baoxian_need_sh=true
learning.bj.bj=0.0
sysconf.tzEditorHtml=
zhenshu.need.sh=false
study.course.ctype.z=0
study.course.ctype.x=0
system_conf_https_port=9443
sysconf.newShouye=0
list_page_number=3
system.conf.email.sendcount=30
sd.elclass=\u65E0\u8BB0\u5F55
system.conf.office.size=10
system_cong_is_receive_by_judge=true
public_begin=elstuffs/1273/1371.wma
study.course.ctype.b=0
learning.jh.jh=5.0
public_end2=elstuffs/1273/1419.wma
shebei_need_sh=true
zdy_html=/zdyhtml
shouye.img=\u65E0\u8BB0\u5F55
learning.mk.mk=0.0
system_conf_login_max_sd=0
search_need=false
stuff_size=0
sysconf.tyxtSwf=elstuffs/1515/1519.swf
learning.xf.xf=5.0
fileupload_need_zh=true
index_classid=0
system_conf_http_port=9080
sysconf.ktxzSwf=elstuffs/1515/1519.swf


0x03:一处FTP

##########serv-u configs
ip=192.168.1.101
port=21
username=sopia
password=123


连接一处数据库作为测试：

1.png

修复方案：

安全不可忽视！希望正确面对网络安全问题。
更多隐患自己排查！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-05-05 17:00

厂商回复：

CNVD未直接复现所述情况，已经由CNVD通过网站公开联系方式向网站管理单位通报。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-05-01 12:08 | 茜茜公主 ( 普通白帽子 | Rank:2360 漏洞数:406 | 家里二宝出生，这几个月忙着把屎把尿...忒...)

    看到可查任何人，我就震精了

  2. 2015-05-01 12:41 | ca1n ( 普通白帽子 | Rank:100 漏洞数:22 | not yet)

    警察叔叔就是这个人

  3. 2015-05-19 22:20 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:179 | 力不从心)

    那么牛逼？没看出来可以查任何人的样子，这个任何人是说在这个平台上注册的人？