当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156063

漏洞标题：再牛逼的防火墙也敌不过一个reboot之网络基础设施安全（reboot/del/rm）

相关厂商：cncert国家互联网应急中心

漏洞作者： 一只猿

提交时间：2015-11-26 16:32

修复时间：2016-01-14 16:28

公开时间：2016-01-14 16:28

漏洞类型：基础设施弱口令

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-26： 细节已通知厂商并且等待厂商处理中
2015-11-30： 厂商已经确认，细节仅向厂商公开
2015-12-10： 细节向核心白帽子及相关领域专家公开
2015-12-20： 细节向普通白帽子公开
2015-12-30： 细节向实习白帽子公开
2016-01-14： 细节向公众公开

简要描述：

我依稀记得匿名者曾经声称要让全中国断网，当时觉得有点夸张。
但是现在....俨然成为一个事实，而且，还很容易
那，到底是谁的错呢？

详细说明：

如果结合之前的两个设备会更劲爆
http://**.**.**.**/bugs/wooyun-2010-0144850
http://**.**.**.**/bugs/wooyun-2010-0155584
要问我如何快速扫描定位目标的？
因为我有一个牛逼的设备特征库
好了，废话不多说，开始撸。
噪起来吧～
首先来说说如何生成一个通用的telnet特征库，这里撸主没有说成指纹库而说成特征库，是因为我所生成的特征并不能精确到100%，因为只要随意修改一点点设备的信息，即可生成一个新的特征，所以只能作为参考。但是针对于大多数设备，尤其是针对某些比较有影响力的设备进行扫描的时候特别好使。
Python大法好，先写一个多线程的脚本，批量扫描IP段，获取telnet返回的欢迎信息。撸主在http://**.**.**.**/bugs/wooyun-2010-0144850 这个洞里面说过，欢迎信息是很有用的，这些欢迎信息基本上没有人去修改，虽然有些设备确实可以自定义，但是在大量设备面前，我相信运营商也不会闲的蛋疼要OEM厂商生成独一无二的欢迎信息，也不会要求运维人员部署的时候去diy一下。所以，根据这些就很容易识别通用的设备。
获取到欢迎信息后可以用喜欢的加密方式生成一串特征码，撸主用的MD5，将这些特征码和对应的设备型号以及可能存在的通用口令存储到远程服务器上生成API接口，方便调用。
好了，方法就说到这，剩下的童鞋们自由发挥吧。

漏洞证明：

接下来进入今天的主题，通过扫描相同一款设备的时候很容易发现，像之前提到的两个洞里面的两款设备的IP都很有意思，基本上都是存在一个段或相近的段里面。这对我们的扫描很有帮助。你甚至可以根据IP段的规律推断出哪些IP段可能存在通信性设备，因为，人的惰性。
首先要说的是中兴一款设备：ZXA10 C300
官方的介绍在这

http://**.**.**.**/cn/products/access/xpon/201405/t20140519_424002.html

同样的撸主会选取两段话来说明设备的用途以及风险

ZXA10 C300是一款大容量、高密度的xPON汇聚接入平台，支持面向下一代网络的HSI、VoIP、TDM、IPTV、CATV、移动2G/3G、WiFi等全业务的接入汇聚和管理控制，并提供电信级的QoS和安全可靠性保障。

面向下一代的xPON统一平台架构，支持EPON/GPON/P2P/10G PON/NG PON2融合接入，满足全业务发展需求。

适应TDM和移动Backhaul承载，完善的VLAN/组播/QoS业务能力和优异的业务性能，符合光进铜退和三网合一大背景下建网需求。

从介绍中可以看出此系列产品用于长距离光型号通信以及三网融合通信方面。很显然，一旦被控制，后果不堪设想。
那我们就来看下，怎么控制呢。撸主这里随便选取一个扫描到的IP，毕竟这设备实在是太多了，随随便便一扫就是一片，通过默认口令zte/zte直接登录进去就是最高权限。

ZXANall.png

从图上可以看出命令相当丰富，其中不乏一些敏感的命令，比如 reboot、reset-card、rmdir，可以干啥就不用说了吧。
同样的，一个IP并不能说明问题，这里就举个例子，简直信手拈来。比如安徽电信的一个段 **.**.**.**/24 ，撸主手一抖就写了一个批量扫描登录并获取返回信息的脚本，噪起来吧，看个图

zxan.png

看图实在是不直观，列出来吧

--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW14-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW16-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-12-1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:gjjy8dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q61D1dySP#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW18-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW15-2dy#
-------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q62D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW8D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q43D2DY#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW1D1DY#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:gxjy7dong5dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW13-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW17-4dy#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW9D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**43
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-5#2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:LG_sushe-1lou-2shang#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**0
device:Welcome to ZXAN product  of ZTE Corporation
result:ShanShuiHuaTing58#2#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YingHeBiShuiWan_26-2-2lou#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**47
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-4#2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**7
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q66D4dySP#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**4
device:Welcome to ZXAN product  of ZTE Corporation
result:ShanShuiHuaTing63#1#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**59
device:Welcome to ZXAN product  of ZTE Corporation
result:CQXZF-1lou-xi#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**2
device:Welcome to ZXAN product  of ZTE Corporation
result:lgcq1haoff#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-3-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW3D2dy2F#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**11
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG1dong6dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:ChaoYueDianZi#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**22
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG-10-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**45
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-6#1dy#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q42D2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q53D2dySP#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-12-3dy-1F#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**16
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG5dibf1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:QCGCXY-5-2-XI-1#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**17
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG6dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**13
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG2dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**6
device:Welcome to ZXAN product  of ZTE Corporation
result:LG_sushe-1lou-2xia#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-2-2-2lou#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**50
device:Welcome to ZXAN product  of ZTE Corporation
result:YJB-29-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**06
device:Welcome to ZXAN product  of ZTE Corporation
result:HaoZhong#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q55D2dy#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**23
device:Welcome to ZXAN product  of ZTE Corporation
result:blsjy16dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:QCGCXY-5-2-XI-2#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT31-48#2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW10DBS#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**3
device:Welcome to ZXAN product  of ZTE Corporation
result:lgcq2haoff#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**57
device:Welcome to ZXAN product  of ZTE Corporation
result:BB-XQZF-F820#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:gxjy7dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**0
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q69Dsp#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**12
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYGshangpu-xi#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:FHJDSCQ8dong2#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**33
device:Welcome to ZXAN product  of ZTE Corporation
result:RYDZ#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**21
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG9dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-12-3-2lou#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**5
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q53D4dySP#
-------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**53
device:Welcome to ZXAN product  of ZTE Corporation
result:QZJ-gongsi#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**65
device:Welcome to ZXAN product  of ZTE Corporation
result:HSGS-1#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**54
device:Welcome to ZXAN product  of ZTE Corporation
result:HS-chuanyegongsi#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**58
device:Welcome to ZXAN product  of ZTE Corporation
result:CQXZF-6-lou#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**46
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-6#3dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**31
device:Welcome to ZXAN product  of ZTE Corporation
result:FFLQQ#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**32
device:Welcome to ZXAN product  of ZTE Corporation
result:TuShanYanYiChang#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**20
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYGwuye#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**4
device:Welcome to ZXAN product  of ZTE Corporation
result:lgcq3haokf#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**19
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG-8-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**8
device:Welcome to ZXAN product  of ZTE Corporation
result:HFJXC#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**10
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG1dong4dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW5D3dy2F#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**09
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG1dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q-45-2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**8
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q67D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**3
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q-52-2#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**18
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG7dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW2D2dy1FSP#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**2
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q61D4dySP#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**56
device:Welcome to ZXAN product  of ZTE Corporation
result:FHJD#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**9
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q68D1dy#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**14
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG3dong1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q-46shangpu#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**39
device:Welcome to ZXAN product  of ZTE Corporation
result:HFJD-3#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**42
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-4#4dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW-6-1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q-47you_er#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q47D2dy#
 --------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**2
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q51D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**52
device:Welcome to ZXAN product  of ZTE Corporation
result:CQXZF#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**1
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q49D2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:lgcq4haokf#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW7D1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW17#2#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW11D2DY2f#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**44
device:Welcome to ZXAN product  of ZTE Corporation
result:HGYB-5-4dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**48
device:Welcome to ZXAN product  of ZTE Corporation
result:YJB-27-1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**6
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q66D2dySP#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**8
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q-57#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:FHJDSCQ5dong#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW5D1dy2F#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**15
device:Welcome to ZXAN product  of ZTE Corporation
result:JSYG4dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW16-4dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**24
device:Welcome to ZXAN product  of ZTE Corporation
result:blsjy17dong2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**5
device:Welcome to ZXAN product  of ZTE Corporation
result:SSHT3Q65D2dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**8
device:Welcome to ZXAN product  of ZTE Corporation
result:gxjy7dong-sp#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**49
device:Welcome to ZXAN product  of ZTE Corporation
result:YJB-18-1dy#
--------------------------------------------------------------------------------
2015/11/26 11:37:37 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:YHBSW4D1dy2F#

看的不爽？再来个段，依然是安徽电信**.**.**.**/24，扫描结果

[log] Total 255 ip , running...
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:bianhexiaoqu-10#2#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:xinyuanshiying#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**01
device:Welcome to ZXAN product  of ZTE Corporation
result:yingrui-zhijianbu#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:zhongcaoxiangliao#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**46
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**42
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**24
device:Welcome to ZXAN product  of ZTE Corporation
result:gongxinlianyou#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:hongshengjingmi#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:yichengboli-dagang#
 --------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:tianyugaowen#
--------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:zhenzhongxiangsu(3lou)#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:yuanfanyaoye#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**38
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**70
device:Welcome to ZXAN product  of ZTE Corporation
result:xinghuokeji-F820#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:xiangyuganggou#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:kangtai#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:bianhexiaoqu-9#2#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**67
device:Welcome to ZXAN product  of ZTE Corporation
result:diwangjiuye-F820#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**49
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:bianhexiaoqu-10#4#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**22
device:Welcome to ZXAN product  of ZTE Corporation
result:zhonghaimiye#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:difakeji-f820#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**02
device:Welcome to ZXAN product  of ZTE Corporation
result:YingRui-f820#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:hongjijiancai#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**18
device:Welcome to ZXAN product  of ZTE Corporation
result:dayuqimao#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**48
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:jiangjiacun-f820#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:23 ip:**.**.**.**00
device:Welcome to ZXAN product  of ZTE Corporation
result:shenzhongkuaidi#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:diwang#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**23
device:Welcome to ZXAN product  of ZTE Corporation
result:runfabaozhuang#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**40
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**44
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**45
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**39
device:Welcome to ZXAN product  of ZTE Corporation
result:ZXAN#
--------------------------------------------------------------------------------
2015/11/26 13:24:24 ip:**.**.**.**
device:Welcome to ZXAN product  of ZTE Corporation
result:lingbao-F820#

实在是太多了，全国撸主就不扫了，挺吓人的
接下来说说另外一个设备，烽火通信的，虽然没有像华为、中兴那么普及，但也是一抓一个准啊
烽火通信的F-engine S3000 和 Fengine S3582MF（属于S3500系列），下面给出根据谷歌找到的一些资料
S3500系列

F-engine S3500是烽火网络推出的千兆三层以太网交换机系列，根据物理端口和交换容量的不同，该系列包括S3528 、S3528MF以及S3552三款设备，均为定位于电信级的产品，主要面向企业网、园区网及IP城域网，实现高密度快速以太网和千兆以太网接口的高速交换和路由。它支持完备和丰富的二/三层协议、流处理、QoS保证机制以及强大的业务处理和认证等应用服务，可以适应各种复杂网络的应用要求。该系列交换机端口配置灵活，操作简单，维护方便，性能稳定，功能强大，可以让用户充分享受宽带互联网带来的乐趣。 S3528交换机提供24个10/100Base-T接口，4组千兆接口，每组千兆接口包括10/100/1000Base-T和SFP接口（不包括SFP模块）。支持220V交流供电或-48V直流供电， SFP模块接口有单模、多模、电口等不同传输距离模块可供选择。 S3552交换机主机提供40个10/100Base-T接口，4组千兆接口，每组千兆接口包括10/100/1000Base-T和SFP接口（不包括SFP模块），可任选其一使用，1个模块插槽（可选插8口100Mbps电口或光口模块），两个电源插槽。 S3528MF模块化三层交换机，3个10/100Base-TX/FX接口模块插槽，1个千兆接口插槽。


S3000 官方的一个介绍http://**.**.**.**/cn/news/4/905.html

此次中标WLAN覆盖项目的产品中，F-engine S3000系列交换机可以作为用户汇聚层快速交换设备，实现高密度千兆以太网接口的高速交换和路由，目前已在宽带城域网组网、小区接入、企业联网、校园组网等中实现了应用并受到广泛好评。S2200ME-PAF系列交换机为以太网POE交换机，可达到全线速转发，支持POE、QINQ、基于VLAN的业务控制，具有强大的ACL、组播和QOS等功能，可提供形象直观、功能强大的图形界面网管系统，支持集群网管，可满足各种场合下宽带网络接入的需求。

随着智能楼宇、开放园区、校园等领域相继成为无线网络建设的热点，烽火网络在运营商采购中多次大份额中标，在中国移动、中国联通、中国电信逐步实现了大规模的应用，获得了理想的市场份额。现已经在广东、湖南、云南、四川、辽宁、山东、黑龙江、湖北、甘肃、安徽等省的建网中都取得规模应用，同时，伴随着三网融合的进一步推进，预计PoE交换机的市场将持续增长。

根据介绍，很容易看出使用范围之广，甚至在智能楼宇中都有应用，已经不仅仅是运营商的问题了，一旦出现问题，风险可想而知。
撸主在找中兴设备的时候意外的找到了一批烽火的设备，看个图

f-engine.png

扫描网段**.**.**.**/24 通过默认口令admin/12345可登录扫描到的烽火的所有设备。设备的外观撸主也找到了一个图参考

T2JP1MXn8XXXXXXXXX_!!1263079.jpg


看下这俩设备能干啥。
S3528MF

S3528MFall.png


S3000

s3000login.png

s3000cmd.png

从图上很清楚的看到两款设备均存在reboot、rmdir等敏感命令。风险依然大大的有
当然，获取撸主提到的设备包括以前提到的设备，实际扫描到的案例数量非常庞大，分布在全国各地，各种场所。这将是非常漫长而且艰巨的修复任务。
更多设备正在陆续扫描验证中...期待吧

修复方案：

如果这是战场....

版权声明：转载请注明来源 一只猿@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-11-30 16:27

厂商回复：

CNVD未直接复现所述情况，已经由CNVD通过网站公开联系方式或以往建立的处置渠道分别向软件生产厂商通报。

最新状态：

暂无

漏洞评价：

评价

  1. 2015-11-26 17:20 | 丶Soim ( 路人 | Rank:0 漏洞数:1 | 一只正在学飞的小菜鸟。)

    相关厂商： cncert国家互联网应急中心漏洞状态： 已交由第三方合作机构(cncert国家互联网应急中心)处理怎么觉得有点....

  2. 2015-11-27 15:27 | 大师兄 ( 路人 | Rank:29 漏洞数:7 | 每日必关注乌云)

    伙计们的，看介个茬！！

  3. 2015-11-27 15:27 | 大师兄 ( 路人 | Rank:29 漏洞数:7 | 每日必关注乌云)

    @一只猿

  4. 2015-11-27 17:03 | cncert国家互联网应急中心(乌云厂商)

    @一只猿 鉴于您对网络设备类风险有较深入研究,商请联系vreport@cert.org.cn,我们向您请教些技术问题. 谢谢.

  5. 2015-11-30 17:39 | 1c3z ( 普通白帽子 | Rank:264 漏洞数:55 | #)

    我要给洞主生猿

  6. 2015-11-30 18:24 | Hackshy ( 实习白帽子 | Rank:47 漏洞数:23 | 猪猪侠爱吃棒棒糖)

    。。。。我要给洞主生娃，楼上是招安的节奏吗

  7. 2015-11-30 22:32 | 孤独的小船 ( 路人 | Rank:8 漏洞数:3 | 一名碌碌无为的网络安全爱好者)

    楼上上上吊...

  8. 2015-12-09 16:34 | phoenixne ( 实习白帽子 | Rank:48 漏洞数:23 | 小本毕业，向各位学习)

    难怪我老断网，原来是你搞的