2015-09-25： 细节已通知厂商并且等待厂商处理中 2015-09-25： 厂商已经确认，细节仅向厂商公开 2015-10-05： 细节向核心白帽子及相关领域专家公开 2015-10-15： 细节向普通白帽子公开 2015-10-25： 细节向实习白帽子公开 2015-11-09： 细节向公众公开
一个小小的运维缺陷引发的血案。。。。
rsync服务器配置失误，对外开放且无需认证。这是第二次了，之前猪哥发过 http://www.wooyun.org/bugs/wooyun-2013-034737同网段扫了一下873端口就发现58.68.255.59也存在如上配置问题。（运维的同学啊....）
rsync 58.68.255.59::
接着看了下源码:
rsync 58.68.255.59::site/www/html/m.tuniu.com/svnInfo.php svnInfo.php
一个svn操作的文件:
<?php mask 区域 *****rors", &**********访问日志存**********039;,'/opt/t**********N', '**********#039;, '218**********Publi**********vate $**********vate $**********e_up; //更**********e_add; //^**********_add; //添**********rror; //^**********truct($user_**********VN_AUTH_PARAM_DEFAULT********** SVN_AUTH_PARAM_DEFA**********->_file_**********gt;_file_add**********->_dir_a********** ********** **********文件路径********** **********am array********** **********n_up_versi**********! is_array**********;_error = "P**********n $this->set********** **********date_info **********each($file********** $file = **********gt;file_copy( $f**********;check_file_status( $f**********)){ //表示是提交^********** $update_info********** ********** 如果是文件则先**********ir($file) &&********** $unlink = **********n unlink".date('Y-m-d H:i:s').'********** i**********is->file_resume********** $this->_error = **********eturn $this->set_r********** ********** ********** $result = sv********** **********state = $this->che**********= '-2'){ //文^********** $this->file_re********** $this->_error = &********** return $this->********** ********** if(! is********** $this->c********** $t********** $this->_error ********** return $this->********** **********{ //文件更新失********** $this->che********** $thi**********this->_error = &qu**********eturn $this->set_r********** ********** $update_info********** ********** **********uxiaomin 更********** ((array)$fi**********$this->veri**********$verifySv**********is->fil**********gt;_error = **********>set_result(********** } ********** **********temp_file(); //**********s->set_resu**********>set_result(********** ********** **********svn up是**********am array********** **********rifySvnU**********^^不需^**********s_dir($**********eturn a********** **********le = tri**********^文件是**********file_exis**********#039;,'not fil********** **********件版本是**********vn_status($f**********f (!$st**********;,'svn_status re********** **********'text_sta**********^修改，请先联系管理^********** **********tus[0]['**********]['revision&**********['cmt_rev********** if (!**********39;,'not exists********** **********iff($url,SVN_REVISIO********** if (!**********#039;,'svn dif********** ********** $error_conten**********($erro**********(!feof($e**********nts .= fread(********** **********close($********** ********** if ($**********le(!feof**********nts .= fread********** **********close($********** **********ents || $er**********39;svn diff isnot curr********** ********** **********y($file,$cmt_r********** }**********svn_log_l**********= $arr['u********** = $arr['********** = $arr['********** = $arr['**********039;] ? $arr['repos_u**********l = realpath(********** $lim**********f($limit ********** retur********** **********prevent server fro**********$arr['**********'] . " -q --config-dir /home/apache/.********** }**********d_date . "} -q --limit $limit $repos_url --config-dir ********** **********39;/^r(\d+) /m********** $ret = **********ch($matches**********= svn_log( $rep**********$log[0]; // log i********** **********his->set_r********** **********svn_st_in**********= $arr['u********** = $arr['**********039;] ? $arr['repos_u**********l = realpath(**********= $arr['**********($array as $**********['file_name'] . " --config-dir /home/********** **********his->set_r********** **********svn_file_**********= $arr['u********** = $arr['**********039;] ? $arr['file_u**********rl = realpat**********array = a**********tatus( trim( $fi**********&& is_**********ion'] = $result[********** **********le_info'] =**********his->set_r********** ********** **********文件********** ********** unknown_********** **********file_copy**********file_exist**********this->_fil**********h = "svn_cop**********is_dir( dirname**********ir( dirname( $copy********** ********** @copy( $fil********** }**********this->_fil********** ********** ********** **********文件********** ********** **********n file_r**********^^新的^**********up = $this-&**********&& is_a**********oreach($files**********d_path = "svn********** @copy( $o********** ********** **********^^加的^**********add = $this-**********amp;& is_arr**********oreach($files********** //huxiaom**********mand = " rm********** exe********** //@svn_delet********** ********** **********加的文^********** = $this-&g**********&& is********** foreach($di********** $demand = "********** exe********** ********** **********/删除^**********is->rm_********** ********** **********^除临********** ********** **********n rm_tem**********ot; rm -rf svn_********** exec( $********** ********** **********^查文********** ********** unknown_**********eturn u********** **********eck_file_s**********os( $file, &********** $dir = dirn**********_dir( $dir )){ /**********svn_dir = $this-&**********array ( $svn_dir ); ********** ********** **********= @svn_status(**********/print_r(**********ile_info){ /********** return &********** **********'locked'********** @svn_cle********** **********9;text_status'********** @svn_rev********** return &********** ********** r********** ********** **********创建文********** ********** **********recurse_m**********t_path = &q**********xplode( '/**********ch($path_ar********** **********start_path ? $start_path********** if(! is_dir(********** svn_mkdir(********** ********** ********** ********** ********** **********找出上级存^********** **********dir_svn_u**********f(! is_di********** $path_cu**********rr = explode( **********rr_new = array_r**********oreach($path_********** **********tr( $path_current, 0, strlen(**********( '#/$#', '',**********ir( $path_temp ) &&a********** $version = @sv********** $this->_**********n array ( $path_current =&g********** ********** $path_c********** ********** ********** ********** ********** **********文件到********** ********** unknown_**********eturn u********** **********resume_vers**********! is_array********** re********** **********date_info **********($files as $********** $file = **********->check_file**********gt;file_copy( $f********** svn_update( $fil**********//文件的更新失**********this->check_fi********** $this->**********->_error = "**********n $this->set_res********** **********e = $this->check**********039;-2'){ //文件^********** $this->file_resu**********this->_error = &qu**********eturn $this->set_r********** ********** **********update_info[$********** **********is->rm_**********>set_result(********** **********get_svn_i**********! is_array********** re********** **********file_info**********each($file********** svn_status( trim**********ult && i**********e_info = explode( **********= $file_name_info[coun**********rsion = $result[0]********** $file_info[$********** ********** **********eturn $fi********** **********files($file********** ) . "/" . **********s->get_all_********** **********get_all_f********** $list =**********path . '/*&********** if(is_di**********en( $path ) + 1, strlen( $item ********** **********em, strlen( $path ) + 1, st********** ********** ********** retu********** ********** **********一组sql********** **********nknown_typ**********eturn u********** **********query_sql**********$pragrams[********** $pragrams[**********is_array( $********** re********** **********;addConnect( **********each($sql_********** $this->q********** ********** ********** **********一个数********** **********nfo 数据库用^********** ********** **********ion addConn**********o['db_user'], $db_info['********** if(!**********^服务器' . $db_info[********** **********_db( $db_info[**********^^库' . $db_info['d********** **********( "set na**********is->_li********** **********nction qu**********mysql_query( $sql**********f(! $this********** ********** }********** ********** ********** ********** **********信息********** ********** unknown_********** **********encode_ms**********lencode( seri**********g = serial********** ********** **********信息********** ********** unknown_********** **********decode_ms**********rialize( urlde**********= json_deco********** **********set_resul**********t error".date('Y-m-d H:i:s********** $arr = **********ror = $thi********** if($**********r['error&********** }**********arr['suc********** **********'res********** retu********** ********************;username'], $_REQ**********EST['**********>decode**********msg( $_REQUEST[**********ST['ver**********39;Y-m-d H:**********uest($sta**********; . 'IP********************/********** service_**********rvice_verify )**********'NO PER********************ams )){ //^********** . 'PRAFRA********************lish, $act )){********************->$act( **********gt;encode_ms**********^日**********arra**********$_REQUEST['**********039; =&g**********#039;=>**********#039;=>**********;**********log,$st**********uot; . $r*********************^^^********************************ice_ver**********ame = __**********s = arr**********fy = ar**********9;i' ) - 1, 0, 2 + date( 'm' ),**********039;i' ), 0, 2 + date( 'm' ), **********9;i' ) + 1, 0, 2 + date( 'm' ),**********($times **********name . "ve**********rify[] = m********** **********urn $v*******************************期，访问ip*********************e='',$lo**********VNPUBLISH**********xists($f********** = '********** }********** = get**********te('Y-m').**********39;)."\t ".$realip."**********ilename,$mess********************getIp**********HTTP_X_FORWARDE**********uot;HTTP_X_FORW**********"HTTP_CLIE**********R["HTTP_********** el**********R["REMOT********** }**********n $re********************Request($s********** = get**********(',**********) && !in_array**********access'),$startTim**********urn fa********** }**********urn ********************/code**********^^传入可控参数username ， p**********多个站点因此********************^个ex**********gt;&l**********n_st_inf**********serialize********** = ar**********gt; '`/bi**********; => **********#039; =&**********> a**********' => &********** ********** )**********;**********(serialize(********** = ar**********039; =&g**********#039; =>**********;********************com/svnIn**********u.com/svn**********u.com/svn**********iu.com/sv**********iu.com/svn**********u.com/svnI**********iu.com/sv**********.com/svnI**********iu.com/svn********************.com/svnIn**********com/svnInfo**********.cn/svnInfo**********com/svnInf**********nfo.php shell_***************1.://**.**.**//m.tuniu.com/svnInfo.php";_*****rl_in**********CURLOPT_U**********CURLOPT_P**********CURLOPT_H**********y('X-Forwarded-F**********OPT_RETURNT**********OPT_POSTFIE**********url_ex**********ose(**********($re*****
*****rors", &**********访问日志存**********039;,'/opt/t**********N', '**********#039;, '218**********Publi**********vate $**********vate $**********e_up; //更**********e_add; //^**********_add; //添**********rror; //^**********truct($user_**********VN_AUTH_PARAM_DEFAULT********** SVN_AUTH_PARAM_DEFA**********->_file_**********gt;_file_add**********->_dir_a********** ********** **********文件路径********** **********am array********** **********n_up_versi**********! is_array**********;_error = "P**********n $this->set********** **********date_info **********each($file********** $file = **********gt;file_copy( $f**********;check_file_status( $f**********)){ //表示是提交^********** $update_info********** ********** 如果是文件则先**********ir($file) &&********** $unlink = **********n unlink".date('Y-m-d H:i:s').'********** i**********is->file_resume********** $this->_error = **********eturn $this->set_r********** ********** ********** $result = sv********** **********state = $this->che**********= '-2'){ //文^********** $this->file_re********** $this->_error = &********** return $this->********** ********** if(! is********** $this->c********** $t********** $this->_error ********** return $this->********** **********{ //文件更新失********** $this->che********** $thi**********this->_error = &qu**********eturn $this->set_r********** ********** $update_info********** ********** **********uxiaomin 更********** ((array)$fi**********$this->veri**********$verifySv**********is->fil**********gt;_error = **********>set_result(********** } ********** **********temp_file(); //**********s->set_resu**********>set_result(********** ********** **********svn up是**********am array********** **********rifySvnU**********^^不需^**********s_dir($**********eturn a********** **********le = tri**********^文件是**********file_exis**********#039;,'not fil********** **********件版本是**********vn_status($f**********f (!$st**********;,'svn_status re********** **********'text_sta**********^修改，请先联系管理^********** **********tus[0]['**********]['revision&**********['cmt_rev********** if (!**********39;,'not exists********** **********iff($url,SVN_REVISIO********** if (!**********#039;,'svn dif********** ********** $error_conten**********($erro**********(!feof($e**********nts .= fread(********** **********close($********** ********** if ($**********le(!feof**********nts .= fread********** **********close($********** **********ents || $er**********39;svn diff isnot curr********** ********** **********y($file,$cmt_r********** }**********svn_log_l**********= $arr['u********** = $arr['********** = $arr['********** = $arr['**********039;] ? $arr['repos_u**********l = realpath(********** $lim**********f($limit ********** retur********** **********prevent server fro**********$arr['**********'] . " -q --config-dir /home/apache/.********** }**********d_date . "} -q --limit $limit $repos_url --config-dir ********** **********39;/^r(\d+) /m********** $ret = **********ch($matches**********= svn_log( $rep**********$log[0]; // log i********** **********his->set_r********** **********svn_st_in**********= $arr['u********** = $arr['**********039;] ? $arr['repos_u**********l = realpath(**********= $arr['**********($array as $**********['file_name'] . " --config-dir /home/********** **********his->set_r********** **********svn_file_**********= $arr['u********** = $arr['**********039;] ? $arr['file_u**********rl = realpat**********array = a**********tatus( trim( $fi**********&& is_**********ion'] = $result[********** **********le_info'] =**********his->set_r********** ********** **********文件********** ********** unknown_********** **********file_copy**********file_exist**********this->_fil**********h = "svn_cop**********is_dir( dirname**********ir( dirname( $copy********** ********** @copy( $fil********** }**********this->_fil********** ********** ********** **********文件********** ********** **********n file_r**********^^新的^**********up = $this-&**********&& is_a**********oreach($files**********d_path = "svn********** @copy( $o********** ********** **********^^加的^**********add = $this-**********amp;& is_arr**********oreach($files********** //huxiaom**********mand = " rm********** exe********** //@svn_delet********** ********** **********加的文^********** = $this-&g**********&& is********** foreach($di********** $demand = "********** exe********** ********** **********/删除^**********is->rm_********** ********** **********^除临********** ********** **********n rm_tem**********ot; rm -rf svn_********** exec( $********** ********** **********^查文********** ********** unknown_**********eturn u********** **********eck_file_s**********os( $file, &********** $dir = dirn**********_dir( $dir )){ /**********svn_dir = $this-&**********array ( $svn_dir ); ********** ********** **********= @svn_status(**********/print_r(**********ile_info){ /********** return &********** **********'locked'********** @svn_cle********** **********9;text_status'********** @svn_rev********** return &********** ********** r********** ********** **********创建文********** ********** **********recurse_m**********t_path = &q**********xplode( '/**********ch($path_ar********** **********start_path ? $start_path********** if(! is_dir(********** svn_mkdir(********** ********** ********** ********** ********** **********找出上级存^********** **********dir_svn_u**********f(! is_di********** $path_cu**********rr = explode( **********rr_new = array_r**********oreach($path_********** **********tr( $path_current, 0, strlen(**********( '#/$#', '',**********ir( $path_temp ) &&a********** $version = @sv********** $this->_**********n array ( $path_current =&g********** ********** $path_c********** ********** ********** ********** ********** **********文件到********** ********** unknown_**********eturn u********** **********resume_vers**********! is_array********** re********** **********date_info **********($files as $********** $file = **********->check_file**********gt;file_copy( $f********** svn_update( $fil**********//文件的更新失**********this->check_fi********** $this->**********->_error = "**********n $this->set_res********** **********e = $this->check**********039;-2'){ //文件^********** $this->file_resu**********this->_error = &qu**********eturn $this->set_r********** ********** **********update_info[$********** **********is->rm_**********>set_result(********** **********get_svn_i**********! is_array********** re********** **********file_info**********each($file********** svn_status( trim**********ult && i**********e_info = explode( **********= $file_name_info[coun**********rsion = $result[0]********** $file_info[$********** ********** **********eturn $fi********** **********files($file********** ) . "/" . **********s->get_all_********** **********get_all_f********** $list =**********path . '/*&********** if(is_di**********en( $path ) + 1, strlen( $item ********** **********em, strlen( $path ) + 1, st********** ********** ********** retu********** ********** **********一组sql********** **********nknown_typ**********eturn u********** **********query_sql**********$pragrams[********** $pragrams[**********is_array( $********** re********** **********;addConnect( **********each($sql_********** $this->q********** ********** ********** **********一个数********** **********nfo 数据库用^********** ********** **********ion addConn**********o['db_user'], $db_info['********** if(!**********^服务器' . $db_info[********** **********_db( $db_info[**********^^库' . $db_info['d********** **********( "set na**********is->_li********** **********nction qu**********mysql_query( $sql**********f(! $this********** ********** }********** ********** ********** ********** **********信息********** ********** unknown_********** **********encode_ms**********lencode( seri**********g = serial********** ********** **********信息********** ********** unknown_********** **********decode_ms**********rialize( urlde**********= json_deco********** **********set_resul**********t error".date('Y-m-d H:i:s********** $arr = **********ror = $thi********** if($**********r['error&********** }**********arr['suc********** **********'res********** retu********** ********************;username'], $_REQ**********EST['**********>decode**********msg( $_REQUEST[**********ST['ver**********39;Y-m-d H:**********uest($sta**********; . 'IP********************/********** service_**********rvice_verify )**********'NO PER********************ams )){ //^********** . 'PRAFRA********************lish, $act )){********************->$act( **********gt;encode_ms**********^日**********arra**********$_REQUEST['**********039; =&g**********#039;=>**********#039;=>**********;**********log,$st**********uot; . $r*********************^^^********************************ice_ver**********ame = __**********s = arr**********fy = ar**********9;i' ) - 1, 0, 2 + date( 'm' ),**********039;i' ), 0, 2 + date( 'm' ), **********9;i' ) + 1, 0, 2 + date( 'm' ),**********($times **********name . "ve**********rify[] = m********** **********urn $v*******************************期，访问ip*********************e='',$lo**********VNPUBLISH**********xists($f********** = '********** }********** = get**********te('Y-m').**********39;)."\t ".$realip."**********ilename,$mess********************getIp**********HTTP_X_FORWARDE**********uot;HTTP_X_FORW**********"HTTP_CLIE**********R["HTTP_********** el**********R["REMOT********** }**********n $re********************Request($s********** = get**********(',**********) && !in_array**********access'),$startTim**********urn fa********** }**********urn ********************/code**********^^传入可控参数username ， p**********多个站点因此********************^个ex**********gt;&l**********n_st_inf**********serialize********** = ar**********gt; '`/bi**********; => **********#039; =&**********> a**********' => &********** ********** )**********;**********(serialize(********** = ar**********039; =&g**********#039; =>**********;********************com/svnIn**********u.com/svn**********u.com/svn**********iu.com/sv**********iu.com/svn**********u.com/svnI**********iu.com/sv**********.com/svnI**********iu.com/svn********************.com/svnIn**********com/svnInfo**********.cn/svnInfo**********com/svnInf**********nfo.php shell_***************1.://**.**.**//m.tuniu.com/svnInfo.php";_*****rl_in**********CURLOPT_U**********CURLOPT_P**********CURLOPT_H**********y('X-Forwarded-F**********OPT_RETURNT**********OPT_POSTFIE**********url_ex**********ose(**********($re*****
“ok” 标记的是测试成功的站点，而有一些因为php没有安装svn扩展导致php脚本执行报错。简单的sleep 5秒来验证:
http://img.tuniu.com/test.txt?ahttp://img.tuniu.com/test.php?a
#1 rsyncd 加入认证机制，且服务不对外网开放。#2 运维缺陷，安全意识普及。
危害等级：高
漏洞Rank：16
确认时间：2015-09-25 23:18
感谢关注途牛安全，正在紧急修复，话说是该好好做做安全培训了！
暂无
mark
途牛的响应真快，要旅游，找途牛，洞主要让人家中秋加班了，罪过罪过...
途牛响应好快
