当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0162696

漏洞标题：联合汽车电子有限公司WWW主站getshell侧漏580张数据表

相关厂商：联合汽车电子有限公司

漏洞作者： 路人甲

提交时间：2015-12-20 23:48

修复时间：2016-02-01 10:51

公开时间：2016-02-01 10:51

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-20： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-02-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

联合汽车电子有限公司（简称UAES）成立于1995年，是中联汽车电子有限公司和德国罗伯特•博世有限公司在中国的合资企业。公司主要从事汽油发动机管理系统、变速箱控制系统、车身电子、混合动力和电力驱动控制系统的开发、生产和销售。2014年，公司实现销售收入135亿元，员工人数约7355人。
公司总部位于上海市浦东新区，在上海、无锡、西安、芜湖和柳州设有生产基地，并在上海、重庆和芜湖设有技术中心。公司有效整合本地优势和全球领先的技术为国内各汽车厂商提供优质产品和服务，并为满足日益严格的法规要求提供技术支持。

详细说明：

http://www.uaes.com/
联合汽车电子有限公司WWW官网主站

0.png


服务厂商众多，2014年，公司实现销售收入135亿元，员工人数约7355人。

1.png


7001端口采用weblogic存在弱口令
weblogic
weblogic1

2.png


已成马场。。。
马：
http://www.uaes.com:7001/1123/

3.png


http://www.uaes.com:7001/a/

4.png


http://www.uaes.com:7001/cmd/

5.png


http://www.uaes.com:7001/dll/
http://www.uaes.com:7001/ggga/
http://www.uaes.com:7001/tian/
http://www.uaes.com:7001/win/
以上全都是网页马。。官网主站被搞成这样也真是惨。。

6.png


7.png


内网IP，可进一步威胁内网！
数据库配置

<jdbc-driver-params>
    <url>jdbc:oracle:thin:@192.168.51.150:1521/uaesweb</url>
    <driver-name>oracle.jdbc.OracleDriver</driver-name>
    <properties>
      <property>
        <name>user</name>
        <value>dev_sites2</value>
      </property>
    </properties>
    <password-encrypted>{AES}9dXdO5Qhn5fKFlUc+YjSq+tlu71SIMnCFeYJEhU0Z0M=</password-encrypted>
  </jdbc-driver-params>


解密得
dev_sites2
oracle
580张数据表！超多数据

8.png


Query#0 : select table_name from user_tables
TABLE_NAME
VARCHAR2
SYSTEMINFO
ELEMENTCATALOG
SITECATALOG
SYSTEMUSERATTR
SYSTEMUSERS
SYSTEMACL
SYSTEMEVENTS
SYSTEMSQL
RTINFO
SYSTEMSEEDACCESS
SYSTEMITEMCACHE
SYSTEMPAGECACHE
SYSTEMIDGENERATOR
SYSTEMSATELLITE
SYSTEMLOCALALIAS
SYSTEMREMOTEALIAS
SYSTEMLOCALESTRING
SYSTEMTRANSFORMS
ASSETLISTENER_REG
COMPARATORS
FW_PUBLISHINGEVENTREGISTRY
LOCALEMAP
MIMETYPE
STATUSCODE
SEARCHENGINEMETADATACONFIG
PUBLISHEDTAGS
ASSETINDEXSOURCECONFIG
SOURCE
CATEGORY
FW_PUBPROGRESS
ASSETQUEUES
FW_PUBDATASTORE
GLOBAL_Q
FLEXASSETDEF_REG
FW_MSGBUS
PREVIEWGEN
FW_PUBHISTORY
CSEVENTS
OBJECTPUBLISH
DISTRIBUTIONLIST
APPROVEDASSETS
APPROVEDASSETDEPS
PUBLISHEDASSETS
PUBKEYTABLE
APPROVALQUEUE
ASSETEXPORTDATA
ASSETDEFAULTTEMPLATE
ASSETPUBLISHLIST
DELIVERYTYPE
PUBSESSION
PUBMESSAGE
PUBTARGET
PUBTARGET_SITES
FW_PUBTARGET_APPROVALROLES
FW_PUBTARGET_PUBLISHROLES
PUBTARGET_DISTRIBUTION
PUBTARGET_SATELLITES
PUBCONTEXT
EMBEDDEDREFERENCE
CCROLES
USERPUBLICATION
SYSTEMUSERPREFERENCES
WORKFLOWSUBJECT
ASSIGNMENT
WORKFLOWASGSACTION
WORKFLOW
WORKFLOW_ROLES
WORKFLOW_AROLS
WORKFLOW_SITES
WORKFLOW_ASSETS
WORKFLOWROUTES
WORKFLOWROUTES_COND
WORKFLOWROUTES_COMP
WORKFLOWROUTES_DEAD
WORKFLOW_DLGA
WORKFLOW_TACTS
FUNCTIONPRIVS
WORKFLOWSTATUSCODE
WORKFLOWSTATUSCODE_TACTS
WORKFLOWCONDITIONS
WORKFLOWASGACTIONS
WORKFLOWPROACTIONS
WORKFLOWSTPACTIONS
WORKFLOWDLGACTIONS
WORKFLOWGROUPS
WORKFLOWGROUPS_EROLES
WORKFLOWGROUPS_DROLES
WORKFLOWGROUPS_DLOCK
GROUPPARTICIPANTS
WORKFLOWGROUPS_SITES
WORKFLOWDLKACTIONS
WORKFLOWGRPACTIONS
CCFUNCTION
WORKFLOWOBJECTS
WORKFLOWPARTICIPANTS
WORKFLOWOBJSACTION
UNASSIGNEDOBJECTS
OBJECTPRIVS
ASSETPUBLICATION
ASSETSUBTYPES
ASSOCNAMED
ASSOCNAMED_SUBTYPES
ASSETTYPE
ASSETRELATIONTREE
COMPLEXASSETS
TEMPLATE_DIM
TEMPLATE_DIMP
TEMPLATE
TEMPLATE_PUBLISH
TEMPLATE_SUBTYPES
TEMPLATE_ARG
TEMPLATE_ARGVALS
TEMPLATE_COMPOSITION
TEMPLATE_CARGS
TEMPLATE_TNAME
TEMPLATE_THUMB
TEMPLATE_MAP
CSELEMENT_DIM
CSELEMENT_DIMP
CSELEMENT
CSELEMENT_PUBLISH
CSELEMENT_COMPOSITION
CSELEMENT_CARGS
CSELEMENT_ARG
CSELEMENT_ARGVALS
CSELEMENT_MAP
SITEENTRY_DIM
SITEENTRY_DIMP
SITEENTRY
SITEENTRY_PUBLISH
COLLECTION_DIM
COLLECTION_DIMP
COLLECTION_RTGS
COLLECTION
QUERY_DIM
QUERY_DIMP
QUERY_RTGS
QUERY
DIMENSION_DIM
DIMENSION_DIMP
DIMENSION
DIMENSIONSET_DIM
DIMENSIONSET_DIMP
DIMENSIONSET
DIMENSIONSET_EDIM
LOCALETREE
SLOTS_DIM
SLOTS_DIMP
SLOTS
SLOTS_PUBLISH
PAGEATTRIBUTE_DIM
PAGEATTRIBUTE_DIMP
PAGEATTRIBUTE
PAGEATTRIBUTE_PUBLISH
PAGEATTRIBUTE_ARGS
PAGEATTRIBUTE_EXTENSION
PAGEATTRIBUTE_SUBTYPES
PAGEFILTER_DIM
PAGEFILTER_DIMP
PAGEFILTER
PAGEFILTER_PUBLISH
PAGEFILTER_ARGS
PAGEDEFINITION_DIM
PAGEDEFINITION_DIMP
PAGEDEFINITION
PAGEDEFINITION_PUBLISH
PAGEDEFINITION_TATTR
PAGEDEFINITION_TFILTER
PAGE_DIM
PAGE_DIMP
PAGE_RTGS
PAGE
PAGE_PUBLISH
PAGE_MUNGO
EXTERNALCLIENTS
EXTERNALCLIENTSCONFIG
FW_TAG
WEBREFERENCES
WEBREFERENCESPATTERNS
PUBLICATION
PUBLICATIONTREE
PUBLICATION_REPLICATE
SITEPLANTREE
TNAMES
CHECKOUTINFO
SAVESEARCH
SAVESEARCH_ROLES
SAVESEARCH_SITES
TEMPOBJECTS
STARTMENU
MENULEGALARGS
STARTMENU_SITES
STARTMENU_ROLES
STARTPROCESSCHOICE
STARTPARTICIPANTCHOICE
STARTMENU_SCHOICES
MENUARGS
ACTIVELIST
TREETABS
TREETABS_ROLES
TREETABS_SITES
TREETABS_SECT
TREETABS_SECT_ROLES
TREETABS_SECT_SITES
TREETABS_ITEMS
REPLICATE
REPLICATE_ASSETTYPES
REPLICATE_ASSETS
ASSETSTUBELEMENTCATALOG
INDEXSOURCEMETADATACONFIG
UITAGITEM
UIUSERLOGGEDINDETAILS
FW_ATTRIBUTERENDERERCONFIG
UITAG
FILTERS
FLEXASSETTYPES
FLEXGROUPTYPES
FLEXTMPLTYPES
FLEXGRPTMPLTYPES
FLEXFILTERTYPES
VMACCESSKEY
VMACCESSMETHOD
VMATTRIBUTECATEGORY
VMSCALARATTRIBUTEDEF
VMHISTORYATTRIBUTEDEF
VMHISTORYATTRIBUTEFIELDDEF
VMHISTORYATTRIBUTEFIELD
VMVISITOR
VMVISITORALIAS
VMVISITORSCALARVALUE
VMVISITORSCALARBLOB
OBJECTREGISTRY
SCRATCH
RULESETDEF
RULEMAP
CARTSET
MUNGOBLOBS
TEMPBLOBS
ATTRTYPES_DIM
ATTRTYPES_DIMP
ATTRTYPES
ATTRTYPES_PUBLISH
ADVCOLS_DIM
ADVCOLS_DIMP
ADVCOLS
ADVCOLS_PUBLISH
ADVCOLS_SSPEC
ADVCOLS_MANREC
ADVCOLS_TYPES
ADVCOLS_EXTENSION
SEGMENTS_DIM
SEGMENTS_DIMP
SEGMENTS
SEGMENTS_PUBLISH
SEGMENTS_EXTENSION
PROMOTIONS_DIM
PROMOTIONS_DIMP
PROMOTIONS
PROMOTIONS_PUBLISH
PROMOTIONS_MANREC
PROMOTIONS_GOALS
PROMOTIONS_EXTENSION
SCALARVALS_DIM
SCALARVALS_DIMP
SCALARVALS
SCALARVALS_PUBLISH
SCALARVALS_EXTENSION
HISTORYVALS_DIM
HISTORYVALS_DIMP
HISTORYVALS
HISTORYVALS_PUBLISH
HISTORYVALS_EXTENSION
HFIELDS_DIM
HFIELDS_DIMP
HFIELDS
HFIELDS_PUBLISH
HFIELDS_EXTENSION
DEVICEGROUP
DEVICEGROUP_DIM
DEVICEGROUP_DIMP
DEVICE_DIMP
DEVICE_DIM
DEVICEREPOSITORY
DEVICE
SITEPLAN
SITEPLAN_DIMP
SITEPLAN_DIM
CONTENTQUERY
CONTENTQUERY_DIM
CONTENTQUERY_DIMP
CONTENTQUERY_RTGS
WEBROOT
WEBROOT_DIM
WEBROOT_DIMP
CONTENT_F_DIM
CONTENT_F_DIMP
CONTENT_F
CONTENT_F_PUBLISH
CONTENT_F_ARGS
CONTENT_A_DIM
CONTENT_A_DIMP
CONTENT_A
CONTENT_A_PUBLISH
CONTENT_A_ARGS
CONTENT_A_EXTENSION
CONTENT_A_SUBTYPES
CONTENT_PD_DIM
CONTENT_PD_DIMP
CONTENT_PD
CONTENT_PD_PUBLISH
CONTENT_PD_TATTR
CONTENT_PD_TGROUP
CONTENT_PD_TFILTER
CONTENT_CD_DIM
CONTENT_CD_DIMP
CONTENT_CD
CONTENT_CD_PUBLISH
CONTENT_CD_TATTR
CONTENT_CD_TGROUP
CONTENT_CD_TFILTER
CONTENT_P_DIM
CONTENT_P_DIMP
CONTENT_P_RTGS
CONTENT_P
CONTENT_P_PUBLISH
CONTENT_P_MUNGO
CONTENT_P_AMAP
CONTENT_P_RMAP
CONTENT_P_EXTENSION
CONTENT_P_GROUP
CONTENT_P_ROOT
CONTENT_C_DIM
CONTENT_C_DIMP
CONTENT_C_RTGS
CONTENT_C
CONTENT_C_PUBLISH
CONTENT_C_MUNGO
CONTENT_C_AMAP
CONTENT_C_RMAP
CONTENT_C_EXTENSION
PRODUCT_F_DIM
PRODUCT_F_DIMP
PRODUCT_F
PRODUCT_F_PUBLISH
PRODUCT_F_ARGS
PRODUCT_A_DIM
PRODUCT_A_DIMP
PRODUCT_A
PRODUCT_A_PUBLISH
PRODUCT_A_ARGS
PRODUCT_A_EXTENSION
PRODUCT_A_SUBTYPES
PRODUCT_PD_DIM
PRODUCT_PD_DIMP
PRODUCT_PD
PRODUCT_PD_PUBLISH
PRODUCT_PD_TATTR
PRODUCT_PD_TGROUP
PRODUCT_PD_TFILTER
PRODUCT_CD_DIM
PRODUCT_CD_DIMP
PRODUCT_CD
PRODUCT_CD_PUBLISH
PRODUCT_CD_TATTR
PRODUCT_CD_TGROUP
PRODUCT_CD_TFILTER
PRODUCT_P_DIM
PRODUCT_P_DIMP
PRODUCT_P_RTGS
PRODUCT_P
PRODUCT_P_PUBLISH
PRODUCT_P_MUNGO
PRODUCT_P_AMAP
MEDIA_P_AMAP
MEDIA_P_RMAP
MEDIA_P_EXTENSION
MEDIA_P_GROUP
MEDIA_P_ROOT
MEDIA_C_DIM
MEDIA_C_DIMP
MEDIA_C_RTGS
MEDIA_C
MEDIA_C_PUBLISH
MEDIA_C_MUNGO
MEDIA_C_AMAP
MEDIA_C_RMAP
MEDIA_C_EXTENSION
DOCUMENT_F_DIM
DOCUMENT_F_DIMP
DOCUMENT_F
DOCUMENT_F_PUBLISH
DOCUMENT_F_ARGS
DOCUMENT_A_DIM
DOCUMENT_A_DIMP
DOCUMENT_A
DOCUMENT_A_PUBLISH
DOCUMENT_A_ARGS
DOCUMENT_A_EXTENSION
DOCUMENT_A_SUBTYPES
DOCUMENT_PD_DIM
DOCUMENT_PD_DIMP
DOCUMENT_PD
DOCUMENT_PD_PUBLISH
DOCUMENT_PD_TATTR
DOCUMENT_PD_TGROUP
DOCUMENT_PD_TFILTER
DOCUMENT_CD_DIM
DOCUMENT_CD_DIMP
DOCUMENT_CD
DOCUMENT_CD_PUBLISH
DOCUMENT_CD_TATTR
DOCUMENT_CD_TGROUP
DOCUMENT_CD_TFILTER
DOCUMENT_P_DIM
DOCUMENT_P_DIMP
DOCUMENT_P_RTGS
DOCUMENT_P
DOCUMENT_P_PUBLISH
DOCUMENT_P_MUNGO
DOCUMENT_P_AMAP
DOCUMENT_P_RMAP
DOCUMENT_P_EXTENSION
DOCUMENT_P_GROUP
DOCUMENT_P_ROOT
DOCUMENT_C_DIM
DOCUMENT_C_DIMP
DOCUMENT_C_RTGS
DOCUMENT_C
DOCUMENT_C_PUBLISH
DOCUMENT_C_MUNGO
PRODUCT_P_RMAP
PRODUCT_P_EXTENSION
PRODUCT_P_GROUP
PRODUCT_P_ROOT
PRODUCT_C_DIM
PRODUCT_C_DIMP
PRODUCT_C_RTGS
PRODUCT_C
PRODUCT_C_PUBLISH
PRODUCT_C_MUNGO
PRODUCT_C_AMAP
PRODUCT_C_RMAP
PRODUCT_C_EXTENSION
MEDIA_F_DIM
MEDIA_F_DIMP
MEDIA_F
MEDIA_F_PUBLISH
MEDIA_F_ARGS
MEDIA_A_DIM
MEDIA_A_DIMP
MEDIA_A
MEDIA_A_PUBLISH
MEDIA_A_ARGS
MEDIA_A_EXTENSION
MEDIA_A_SUBTYPES
MEDIA_PD_DIM
MEDIA_PD_DIMP
MEDIA_PD
MEDIA_PD_PUBLISH
MEDIA_PD_TATTR
MEDIA_PD_TGROUP
MEDIA_PD_TFILTER
MEDIA_CD_DIM
MEDIA_CD_DIMP
MEDIA_CD
MEDIA_CD_PUBLISH
MEDIA_CD_TATTR
MEDIA_CD_TGROUP
MEDIA_CD_TFILTER
MEDIA_P_DIM
MEDIA_P_DIMP
MEDIA_P_RTGS
MEDIA_P
MEDIA_P_PUBLISH
MEDIA_P_MUNGO
DOCUMENT_C_AMAP
DOCUMENT_C_RMAP
DOCUMENT_C_EXTENSION
FW_INVALIDATIONMEMORY
FSIIVISITORATTR_DIM
FSIIVISITORATTR_DIMP
FSIIVISITORATTR
FSIIVISITORATTR_PUBLISH
FSIIVISITORATTR_ARGS
FSIIVISITORATTR_EXTENSION
FSIIVISITORATTR_SUBTYPES
FSIIVISITORPDEF_DIM
FSIIVISITORPDEF_DIMP
FSIIVISITORPDEF
FSIIVISITORPDEF_PUBLISH
FSIIVISITORPDEF_TATTR
FSIIVISITORPDEF_TGROUP
FSIIVISITORPDEF_TFILTER
FSIIVISITORDEF_DIM
FSIIVISITORDEF_DIMP
FSIIVISITORDEF
FSIIVISITORDEF_PUBLISH
FSIIVISITORDEF_TATTR
FSIIVISITORDEF_TGROUP
FSIIVISITORDEF_TFILTER
FSIIVISITORPARENT_DIM
FSIIVISITORPARENT_DIMP
FSIIVISITORPARENT_RTGS
FSIIVISITORPARENT
FSIIVISITORPARENT_PUBLISH
FSIIVISITORPARENT_MUNGO
FSIIVISITORPARENT_AMAP
FSIIVISITORPARENT_RMAP
FSIIVISITORPARENT_EXTENSION
FSIIVISITORPARENT_GROUP
FSIIVISITORPARENT_ROOT
FSIIVISITOR_DIM
FSIIVISITOR_DIMP
FSIIVISITOR_RTGS
FSIIVISITOR
FSIIVISITOR_PUBLISH
FSIIVISITOR_MUNGO
FSIIVISITOR_AMAP
FSIIVISITOR_RMAP
FSIIVISITOR_EXTENSION
STYLESHEET
STYLESHEET_DIM
STYLESHEET_RTGS
STYLESHEET_DIMP
FW_CSUSERGROUPS
FW_CSGROUPS
FW_CSSECURITYCONFIG
FW_APPLICATION
FW_APPLICATION_DIM
FW_APPLICATION_DIMP
FW_VIEW
FW_VIEW_DIMP
FW_VIEW_DIM
UAESSITES_F_DIM
UAESSITES_F_DIMP
UAESSITES_F
UAESSITES_F_PUBLISH
UAESSITES_F_ARGS
UAESSITES_C_DIM
UAESSITES_C_DIMP
UAESSITES_C_RTGS
UAESSITES_C
UAESSITES_C_PUBLISH
UAESSITES_C_MUNGO
UAESSITES_C_AMAP
UAESSITES_C_RMAP
UAESSITES_C_EXTENSION
UAESSITES_A_DIM
UAESSITES_A_DIMP
UAESSITES_A
UAESSITES_A_PUBLISH
UAESSITES_A_ARGS
UAESSITES_A_EXTENSION
UAESSITES_A_SUBTYPES
UAESSITES_P_DIM
UAESSITES_P_DIMP
UAESSITES_P_RTGS
UAESSITES_P
UAESSITES_P_PUBLISH
UAESSITES_P_MUNGO
UAESSITES_P_AMAP
UAESSITES_P_RMAP
UAESSITES_P_EXTENSION
UAESSITES_P_GROUP
UAESSITES_P_ROOT
UAESSITES_CD_DIM
UAESSITES_CD_DIMP
UAESSITES_CD
UAESSITES_CD_PUBLISH
UAESSITES_CD_TATTR
UAESSITES_CD_TGROUP
UAESSITES_CD_TFILTER
FW_REGENCRITERIA
UAESSITES_PD_DIM
UAESSITES_PD_DIMP
UAESSITES_PD
UAESSITES_PD_PUBLISH
UAESSITES_PD_TATTR
UAESSITES_PD_TGROUP
UAESSITES_PD_TFILTER


敏感文件就不翻了，仅作危害证明！

漏洞证明：

修复方案：

全盘杀马，修改弱口令，数据库估计已经侧漏很多次了，注意修改关键密码等信息

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

评价