乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-03-31: 细节已通知厂商并且等待厂商处理中 2015-04-03: 厂商已经确认,细节仅向厂商公开 2015-04-06: 细节向第三方安全合作伙伴开放 2015-05-28: 细节向核心白帽子及相关领域专家公开 2015-06-07: 细节向普通白帽子公开 2015-06-17: 细节向实习白帽子公开 2015-07-02: 细节向公众公开
安全不可姗姗来迟!
#一大批政务站点存在S-016命令执行可getshell!URl中均存在:website-rank通用字眼,路径中均存在:UCMSServer各种组合,各种google!案例1说明测试入口:http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.action
dir:/opt/Minge/UCMSServer/tomcat/webapps/website-rank/
root:x:0:0:root:/root:/bin/bashbin:x:1:1:bin:/bin:/sbin/nologindaemon:x:2:2:daemon:/sbin:/sbin/nologinadm:x:3:4:adm:/var/adm:/sbin/nologinlp:x:4:7:lp:/var/spool/lpd:/sbin/nologinsync:x:5:0:sync:/sbin:/bin/syncshutdown:x:6:0:shutdown:/sbin:/sbin/shutdownhalt:x:7:0:halt:/sbin:/sbin/haltmail:x:8:12:mail:/var/spool/mail:/sbin/nologinuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologinoperator:x:11:0:operator:/root:/sbin/nologingames:x:12:100:games:/usr/games:/sbin/nologingopher:x:13:30:gopher:/var/gopher:/sbin/nologinftp:x:14:50:FTP User:/var/ftp:/sbin/nologinnobody:x:99:99:Nobody:/:/sbin/nologindbus:x:81:81:System message bus:/:/sbin/nologinusbmuxd:x:113:113:usbmuxd user:/:/sbin/nologinrpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologinavahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologinvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologinrtkit:x:499:497:RealtimeKit:/proc:/sbin/nologinabrt:x:173:173::/etc/abrt:/sbin/nologinsaslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologinpostfix:x:89:89::/var/spool/postfix:/sbin/nologinhaldaemon:x:68:68:HAL daemon:/:/sbin/nologinntp:x:38:38::/etc/ntp:/sbin/nologinapache:x:48:48:Apache:/var/www:/sbin/nologinavahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologinrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologinnfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologinpulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologingdm:x:42:42::/var/lib/gdm:/sbin/nologinsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologintcpdump:x:72:72::/:/sbin/nologinoracle:x:500:500::/home/oracle:/bin/bashwuzhengfeng:x:501:502::/home/wuzhengfeng:/bin/bashzabbix:x:502:503::/home/zabbix:/bin/bashmysql:x:496:504::/home/mysql:/bin/bashclamav:x:495:492:Clam Anti Virus Checker:/var/clamav:/sbin/nologindb2inst1:x:1004:999::/home/db2inst1:/bin/bashdb2fenc1:x:1003:998::/home/db2fenc1:/bin/bashdasusr1:x:1002:997::/home/dasusr1:/bin/bash
wuzhengf pts/1 221.219.230.175 Mon Mar 30 21:11 still logged in wuzhengf pts/1 122.70.113.17 Mon Mar 30 14:42 - 15:08 (00:25) wuzhengf pts/1 122.70.113.19 Thu Mar 26 16:53 - 16:55 (00:02) wuzhengf pts/1 111.199.50.185 Wed Mar 25 22:05 - 23:24 (01:19) wuzhengf pts/2 118.194.192.100 Tue Mar 24 10:15 - 10:23 (00:07) wuzhengf pts/1 118.194.192.100 Tue Mar 24 09:59 - 10:23 (00:23) wuzhengf pts/1 118.194.192.100 Mon Mar 23 15:17 - 15:43 (00:26) wuzhengf pts/1 118.194.192.100 Mon Mar 23 10:33 - 14:41 (04:08) wuzhengf pts/4 118.194.192.100 Sat Mar 21 13:25 - 13:43 (00:18) wuzhengf pts/3 118.194.192.100 Sat Mar 21 13:23 - 15:41 (02:17) wuzhengf pts/2 118.194.192.100 Sat Mar 21 09:48 - 15:04 (05:16) wuzhengf pts/1 118.194.192.100 Sat Mar 21 09:44 - 15:04 (05:20) wuzhengf pts/1 106.37.213.195 Fri Mar 20 11:27 - 20:10 (08:43) wuzhengf pts/2 122.70.113.17 Thu Mar 19 16:49 - 16:53 (00:03) wuzhengf pts/2 118.194.192.100 Thu Mar 19 16:45 - 16:45 (00:00) wuzhengf pts/1 118.194.192.100 Thu Mar 19 16:07 - 18:26 (02:18) wuzhengf pts/1 118.194.192.100 Thu Mar 19 14:34 - 15:36 (01:02) wuzhengf pts/1 111.193.1.255 Wed Mar 18 22:39 - 23:03 (00:24) wuzhengf pts/2 122.70.113.18 Tue Mar 17 15:25 - 17:40 (02:14) wuzhengf pts/1 122.70.113.18 Tue Mar 17 15:23 - 17:40 (02:17) wuzhengf pts/1 118.194.192.100 Tue Mar 17 14:37 - 14:44 (00:06) wuzhengf pts/1 118.194.192.100 Mon Mar 16 16:38 - 17:56 (01:18) wuzhengf pts/1 118.194.192.100 Mon Mar 16 10:42 - 14:00 (03:17) wuzhengf pts/1 118.194.192.100 Fri Mar 13 16:54 - 18:08 (01:14) wuzhengf pts/1 118.194.192.100 Mon Mar 9 16:24 - 18:51 (02:26) wuzhengf pts/1 118.194.192.100 Mon Mar 9 16:23 - 16:24 (00:00) wuzhengf pts/2 118.194.192.100 Tue Mar 3 10:41 - 16:27 (05:46) wuzhengf pts/4 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00) wuzhengf pts/3 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00) wuzhengf pts/2 118.194.192.100 Tue Mar 3 10:01 - 10:01 (00:00) wuzhengf pts/1 118.194.192.100 Tue Mar 3 09:28 - 12:25 (02:56) wuzhengf pts/2 118.194.192.100 Mon Mar 2 15:47 - 18:12 (02:24) wuzhengf pts/1 118.194.192.100 Mon Mar 2 10:24 - 18:39 (08:15) wuzhengf pts/1 118.194.192.100 Fri Feb 27 11:05 - 18:39 (07:34) wuzhengf pts/1 118.194.192.100 Thu Feb 26 09:23 - 09:34 (00:10) wuzhengf pts/1 118.194.192.100 Wed Feb 25 16:29 - 16:38 (00:08) wuzhengf pts/2 118.194.192.100 Fri Feb 13 11:48 - 14:43 (02:55) wuzhengf pts/1 118.194.192.100 Fri Feb 13 11:08 - 13:21 (02:13) wuzhengf pts/1 61.49.18.11 Wed Feb 11 21:51 - 22:40 (00:49) wuzhengf pts/1 111.193.2.215 Tue Feb 10 22:20 - 22:25 (00:04) wuzhengf pts/1 61.49.18.12 Tue Feb 10 19:00 - 19:44 (00:43) wuzhengf pts/2 111.203.34.12 Tue Feb 10 17:55 - 18:33 (00:38) wuzhengf pts/1 111.203.34.12 Tue Feb 10 17:53 - 18:33 (00:40) wuzhengf pts/1 111.203.34.12 Tue Feb 10 10:59 - 16:45 (05:46) wuzhengf pts/1 118.194.192.100 Tue Feb 10 09:46 - 09:47 (00:00) wuzhengf pts/1 118.194.192.100 Mon Feb 9 20:40 - 20:44 (00:04) wuzhengf pts/3 118.194.192.100 Mon Feb 9 15:59 - 18:16 (02:16) wuzhengf pts/3 118.194.192.100 Mon Feb 9 15:47 - 15:51 (00:04) wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:11 - 16:59 (01:47) wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00) wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00) wuzhengf pts/2 118.194.192.100 Mon Feb 9 15:01 - 15:01 (00:00) wuzhengf pts/1 118.194.192.100 Mon Feb 9 15:00 - 17:52 (02:51)
案例图组:
给予此通用漏洞部分站点:
http://117.78.19.27:9888/website-rank/getVoteRecordByManuscriptId.actionhttp://168.160.193.139:8888/website-rank/addVoteRecord.actionhttp://219.141.213.23/website-rank/addVoteRecord.actionhttp://42.123.76.155:8080/website-rank/addVoteRecord.actionhttp://www.hhhtbtjc.com/website-rank/addVoteRecord.actionhttp://bauhinia.forestry.gov.cn/website-rank/addVoteRecord.actionhttp://42.123.76.89/website-rank/addVoteRecord.actionhttp://219.141.213.23/website-rank/addVoteRecord.actionhttp://www.12320.gov.cn/website-rank/addVoteRecord.actionhttp://www.minge.gov.cn/website-rank/addVoteRecord.action
#含有此WEB程序的政务站点很多,各种命令执行!可以getshell,甚至提升权限!危害多大,你懂我懂大家懂,希望正确面对网络安全问题,尽快修复。作为白帽子这是我应该做的!精华$$有木有!
危害等级:高
漏洞Rank:20
确认时间:2015-04-03 15:40
CNVD确认并复现所述情况,根据测试用例,已经转由CNCERT下发给对应多个分中心,由其后续协调网站管理单位处置。
暂无