当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-092777

漏洞标题：从一个漏洞到再次沦陷中国联通企业信息服务平台(含32个省)

相关厂商：中国联通

漏洞作者： cuger

提交时间：2015-01-20 11:59

修复时间：2015-01-25 12:00

公开时间：2015-01-25 12:00

漏洞类型：文件上传导致任意代码执行

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-20： 细节已通知厂商并且等待厂商处理中
2015-01-25： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

从一个被忽略的漏洞到再次沦陷中国联通企业信息服务平台，之前找到个文件，数了下有32个省的简称

详细说明：

之所以说再次，是因为之前已经被@s0mun5 沦陷过一次了:

http://wooyun.org/bugs/wooyun-2010-079668


被忽略的漏洞是良品铺子的这个漏洞（已经通过微信联系技术人员修改了密码）:

http://wooyun.org/bugs/wooyun-2010-081423


虽然猜出了良品铺子的后台管理口令，不过技术太菜，后台没有拿到shell，该系统是广州信景技术有限公司开发的，还有其他很多成功案例，像中粮我买网、国美等系统也是采用这家公司的，扯远了，回到正题。

漏洞证明：

虽然在后台没有拿到shell，但是后台有短信和邮件的发送接口，如下图所示：

sms1.png


但是这个地方不管是F12，还是查看源文件什么的，是无法直接看到密码的。最后通过burp代理抓到了短信接口的密码，这算是这个系统的一个设计缺陷吧，点击该短信接口，burp拦截后直接返回明文密码，如下图所示：

sms2.jpg


有了短信接口的用户密码，赶紧到那个接口网址去试试，成功登陆：

sms3.png

可以查看所有已发送短信
给自己发条短信测试一下：

sms4.png


IMG_0095.PNG


测试发送短信成功，难道仅仅发发短信就完了？那实在是太没意思了。。。。
素材库—文件库-上传文件，未做任何过滤（以为有了上次会吸取教训，╮(╯▽╰)╭），直接上传webshell，burp代理返回shell路径：

shell.jpg


上菜刀：

chopper.png


开始以为hb.ums86.com只是湖北省的，后来发现，远远不止这些：
tj、gx、zj、yn、ss、sh、sd、sc、nx、ln、jx、js、hi、gs、gd、fj、cq、bh、bj。。。。差不多全国各个省都在这个ip上面
贴一些配置信息吧，

<?xml version="1.0" encoding="utf-8"?><!-- the proxool configuration can be embedded within your own application's.	Anything outside the "proxool" tag is ignored. --><something-else-entirely>	<proxool>		<alias>db_1</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_db1" />			<property name="password" value="im_db1" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_epma</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.213:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="epma" />			<property name="password" value="epma01" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_2</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_db2" />			<property name="password" value="im_db2" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<!-- 在分配连接前后是否进行有效性测试，这个是解决本问题的关?? -->		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_zx</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_zx" />			<property name="password" value="im_zx" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<!-- 在分配连接前后是否进行有效性测试，这个是解决本问题的关?? -->		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_js</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_js" />			<property name="password" value="im_js" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<!-- 在分配连接前后是否进行有效性测试，这个是解决本问题的关?? -->		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_jx</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_jx" />			<property name="password" value="im_jx" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<!-- 在分配连接前后是否进行有效性测试，这个是解决本问题的关?? -->		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_gd</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_gd" />			<property name="password" value="im_gd" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<!-- 在分配连接前后是否进行有效性测试，这个是解决本问题的关?? -->		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_common</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_common" />			<property name="password" value="im_common" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_stat</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_gd" />			<property name="password" value="im_gd" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_nx</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="im_nx" />			<property name="password" value="im_nx" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_imessage</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="imessage" />			<property name="password" value="imessage" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>		<alias>db_3</alias>		<driver-url>jdbc:oracle:thin:@192.168.1.216:1521/dbtest</driver-url>		<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>		<driver-properties>			<property name="user" value="imessage" />			<property name="password" value="imessage" />		</driver-properties>		<house-keeping-sleep-time>300000</house-keeping-sleep-time>		<simultaneous-build-throttle>2</simultaneous-build-throttle>		<prototype-count>2</prototype-count>		<maximum-connection-count>5</maximum-connection-count>		<maximum-active-time>3600000</maximum-active-time>		<minimum-connection-count>2</minimum-connection-count>		<trace>true</trace>		<test-before-use>true</test-before-use>		<test-after-use>true</test-after-use>		<house-keeping-test-sql>SELECT SYSDATE FROM DUAL		</house-keeping-test-sql>	</proxool>	<proxool>	<alias>db_union_prov</alias>                <driver-url>jdbc:oracle:thin:@192.168.2.223:1521/orcl</driver-url>                <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>                <driver-properties>                        <property name="user" value="im_union_prov" />                        <property name="password" value="ton9y1pl" />                </driver-properties>                <house-keeping-sleep-time>300000</house-keeping-sleep-time>                <simultaneous-build-throttle>100</simultaneous-build-throttle>                <prototype-count>2</prototype-count>                <maximum-connection-count>200</maximum-connection-count>                <maximum-active-time>240000</maximum-active-time>                <minimum-connection-count>2</minimum-connection-count>                <trace>true</trace>                <test-before-use>false</test-before-use>                <test-after-use>false</test-after-use>                <house-keeping-test-sql>SELECT SYSDATE FROM DUAL</house-keeping-test-sql>        </proxool></something-else-entirely>


连接数据库后，全国的企业发送接口都到手了，然后就可以组成短信轰炸机群了，然后就没有然后了。。。。

修复方案：

检查文件的合法性，不能指哪儿补哪儿。

版权声明：转载请注明来源 cuger@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-01-25 12:00

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2015-01-21 11:16 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:179 | 力不从心)

    哦

  2. 2015-01-21 12:55 | cuger ( 普通白帽子 | Rank:200 漏洞数:44 | 这个家伙很懒，什么也没留下)

    @wefgod 干哥好久不见

  3. 2015-01-22 17:04 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:179 | 力不从心)

    @cuger 你认错人了

  4. 2015-01-22 18:21 | cuger ( 普通白帽子 | Rank:200 漏洞数:44 | 这个家伙很懒，什么也没留下)

    @wefgod 哈哈哈哈，怎么可能~

  5. 2015-01-23 09:00 | wefgod ( 普通白帽子 | Rank:1807 漏洞数:179 | 力不从心)

    @cuger 是啊，我是好几个人哈哈

  6. 2015-01-25 18:37 | cuger ( 普通白帽子 | Rank:200 漏洞数:44 | 这个家伙很懒，什么也没留下)

    我擦。。。。为什么忽略了？

  7. 2015-01-27 15:30 | 菜鸟甲 ( 路人 | Rank:28 漏洞数:14 | 啥也不会的菜鸟)

    我擦。这都能忽略。

  8. 2015-09-16 09:29 | Mark0smith ( 路人 | Rank:12 漏洞数:6 | 我更像是一个小松鼠)

    这个好，我要慢慢体会