当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0111432

漏洞标题:国家某安全培训平台getshell&服务器信息&多处数据库&ftp账密可查任何人证件以及身份资料

相关厂商:安全培训平台

漏洞作者: 路人甲

提交时间:2015-05-01 09:25

修复时间:2015-06-19 17:00

公开时间:2015-06-19 17:00

漏洞类型:命令执行

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-01: 细节已通知厂商并且等待厂商处理中
2015-05-05: 厂商已经确认,细节仅向厂商公开
2015-05-15: 细节向核心白帽子及相关领域专家公开
2015-05-25: 细节向普通白帽子公开
2015-06-04: 细节向实习白帽子公开
2015-06-19: 细节向公众公开

简要描述:

国家某安全培训平台getshell&服务器信息&多处数据库可查任何人证件以及身份资料

详细说明:

网站:中国食品安全培训网
描述:站点存在Struts2命令执行漏洞可获取webshell权限
0x01:getshell
地址:http://182.18.30.163/zhengshuchaxun.action

1.png


活动连接
协议 本地地址 外部地址 状态
TCP 0.0.0.0:21 0.0.0.0:0 LISTENING
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:554 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1158 0.0.0.0:0 LISTENING
TCP 0.0.0.0:1521 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3306 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3938 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5520 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5560 0.0.0.0:0 LISTENING
TCP 0.0.0.0:5580 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8009 0.0.0.0:0 LISTENING
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING
TCP 0.0.0.0:30001 0.0.0.0:0 LISTENING
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49159 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49227 0.0.0.0:0 LISTENING
TCP 0.0.0.0:49228 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1521 127.0.0.1:60977 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:60986 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:60987 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:60992 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:61502 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:61595 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:61610 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:61616 ESTABLISHED
TCP 127.0.0.1:1521 127.0.0.1:61621 ESTABLISHED
TCP 127.0.0.1:8005 0.0.0.0:0 LISTENING
TCP 127.0.0.1:43958 0.0.0.0:0 LISTENING
TCP 127.0.0.1:49156 0.0.0.0:0 LISTENING
TCP 127.0.0.1:60977 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:60986 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:60987 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:60992 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:61502 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:61582 127.0.0.1:1521 TIME_WAIT
TCP 127.0.0.1:61590 127.0.0.1:1521 TIME_WAIT
TCP 127.0.0.1:61595 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:61610 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:61616 127.0.0.1:1521 ESTABLISHED
TCP 127.0.0.1:61621 127.0.0.1:1521 ESTABLISHED
TCP 182.18.30.163:80 113.142.157.46:16878 ESTABLISHED
TCP 182.18.30.163:139 0.0.0.0:0 LISTENING
TCP 182.18.30.163:1521 182.18.30.163:49160 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49166 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49167 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49169 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49171 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49209 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:49210 ESTABLISHED
TCP 182.18.30.163:1521 182.18.30.163:61519 ESTABLISHED
TCP 182.18.30.163:3938 182.18.30.163:61624 TIME_WAIT
TCP 182.18.30.163:49160 182.18.30.163:1521 ESTABLISHED
TCP 182.18.30.163:49166 182.18.30.163:1521 ESTABLISHED
TCP 182.18.30.163:49167 182.18.30.163:1521 ESTABLISHED

漏洞证明:

0x02:数据库&配置

##########sqlserver2005 configs
driverClass=net.sourceforge.jtds.jdbc.Driver
maxPoolSize=100
minPoolSize=2
acquireIncrement=2
user=sa
password=1
jdbcUrl=jdbc:jtds:sqlserver://127.0.0.1:1431;DatabaseName=e_gdgat;SelectMethod\=cursor
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
#jdbcUrl=jdbc\:jtds\:sqlserver\://210.51.174.182\:1431;DatabaseName\=elearning_;SelectMethod\=cursor
##########mysql configs
#driverClass=com.mysql.jdbc.Driver
#maxPoolSize=100
#minPoolSize=2
#acquireIncrement=2
#user=root
#password=1
#jdbcUrl=jdbc\:mysql\://localhost\:3306/elearning_qqhr?autoreconnect\=true
##########openmeetings
openmeetings.jdbcUrl=jdbc\:mysql\://localhost\:3306/openmeetings?autoreconnect\=true
openmeetings.user =root
openmeetings.password =1


二、

##########mysql configs
driverClass=oracle.jdbc.driver.OracleDriver
maxPoolSize=100
minPoolSize=2
initialpoolsize=10
acquireIncrement=2
user=wsj20140712
password=wsj20140712
jdbcUrl=jdbc:oracle:thin:@localhost:1521:orcl
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
##########openmeetings
openmeetings.driverClass=com.mysql.jdbc.Driver
openmeetings.jdbcUrl=jdbc:mysql://192.168.9.200:3306/openmeetings_jnt?autoreconnect=true
openmeetings.user =root
openmeetings.password =1


三、

##########mysql configs
driverClass=com.mysql.jdbc.Driver
maxPoolSize=100
minPoolSize=2
acquireIncrement=2
user=root
password=1
jdbcUrl=jdbc:mysql://localhost:3306/e_wx?autoreconnect=true
checkouttimeout=10000
maxidletime =60
idleconnectiontestperiod=60
##########openmeetings
openmeetings.jdbcUrl=jdbc\:mysql\://localhost\:3306/openmeetings?autoreconnect\=true
openmeetings.user =root
openmeetings.password =1


四、

system_jtm_open_jtm=false
system_jtm_my_evaluation_url=http\://182.18.31.226\:8081/kaihangtest/User_login.aspx
system_jtm_report_eval_url = http\://182.18.31.226\:8081/kaihangtest/ReportEval.aspx
system_jtm_peoplePost_url=http\://182.18.31.226\:8081/kaihanghrm/manage/PDjlcx2.aspx
system_jtm_my_report_url=http\://182.18.31.226\:8081/kaihanghrm/manage/ReportPD/reportbmself.aspx
system_jtm_courses_aynchronization_url=http\://182.18.31.226\:8081/kaihanghrm/Manage/courseinfo.aspx
system_jtm_my_cepingCourses_url=http\://182.18.31.226\:8081/kaihanghrm/Manage/getpushclass.aspx
#
#Wed Apr 22 16:30:05 CST 2015
product_fabu_can_alter=true
system.conf.isexam=false
system.conf.msg.password=zahj
publish_option=0
sysconf.ktxzEditorHtml=
sysconf.jsbySwf=elstuffs/1515/1519.swf
sysconf.pxEditorHtml=
study.class.need.sh=false
system.conf.register=1
learning.dl.dl=0.1
stuff_op=false
system_release_question_need_sh=false
system.conf.allowMultipleSign=true
sysconf.sd=1
sysconf.kdhxzSwf=elstuffs/1515/1519.swf
learning.ks.cj=0.0
system.conf.userimp.ischeck=true
system.conf.email.smtp=smtp.qq.com
forum.need.sh=false
sysconf.tyxtEditorHtml=
sysconf.kdhxzEditorHtml=
system.conf.msg.username=zahj
model_working=2
stuff_url_local=1
system.conf.login.addip=0
public_end=elstuffs/1273/1370.wma
knowledge.need.sh=false
learning.xs.xs=3.0
[email protected]
sysconf.pxSwf=elstuffs/1515/1519.swf
sysconf.jsbyEditorHtml=
system_conf_login_failure_max=0
system_conf_login_max=0
sysconf.wjm=1
system.conf.registerinfo.isall=true
openmeetings.url=http\://localhostopenmeetings.admin.user\=admin
system.conf.email.pwds=hlWzjC@610903
sysconf.intelligentTutoringPoints=60
system.conf.ctype.8=4
system.conf.ctype.7=5
learning.xz.xz=0.0
system.conf.ctype.6=4
system.conf.ctype.5=2
system.conf.ctype.4=3
system.conf.database.type=oracle
system.conf.ctype.3=2
system.conf.ctype.2=1
system.conf.ctype.1=1
register.need.sh=false
system.conf.is_enquiry_in_table=false
title_rule=1
learning.bxz.bxz=0.0
sysconf.similarity=60
system.conf.office.home=C\:/Program Files (x86)/OpenOffice.org 3
system_answer_question_need_sh=true
stuff_url=http\://www.cfeu.org/
sysconf.tzSwf=elstuffs/1515/1519.swf
learning.lx.lx=0.0
system.mac_need=false
learning.ft.ft=0.5
line_training_course_add_need_sh=true
learning.btj.btj=0.0
study.course.need.sh=false
system.conf.yzcode.open=0
openmeetings.admin.pwd=admin
sysconf.mac_need=false
system.conf.pdf2swf.path=C\:/Program Files (x86)/SWFTools/pdf2swf.exe
catalogue_place=/html
openmeetings.admin.user=\u65E0\u8BB0\u5F55
learning.sc.sc=5.0
product_need_sh=true
learning.fy.fy=0.1
duandian_need_xc=false
stuff_isftopic=false
shouye.url=\u65E0\u8BB0\u5F55
coursemake.need.sh=false
shipin_need_zh=false
product_baoxian_need_sh=true
learning.bj.bj=0.0
sysconf.tzEditorHtml=
zhenshu.need.sh=false
study.course.ctype.z=0
study.course.ctype.x=0
system_conf_https_port=9443
sysconf.newShouye=0
list_page_number=3
system.conf.email.sendcount=30
sd.elclass=\u65E0\u8BB0\u5F55
system.conf.office.size=10
system_cong_is_receive_by_judge=true
public_begin=elstuffs/1273/1371.wma
study.course.ctype.b=0
learning.jh.jh=5.0
public_end2=elstuffs/1273/1419.wma
shebei_need_sh=true
zdy_html=/zdyhtml
shouye.img=\u65E0\u8BB0\u5F55
learning.mk.mk=0.0
system_conf_login_max_sd=0
search_need=false
stuff_size=0
sysconf.tyxtSwf=elstuffs/1515/1519.swf
learning.xf.xf=5.0
fileupload_need_zh=true
index_classid=0
system_conf_http_port=9080
sysconf.ktxzSwf=elstuffs/1515/1519.swf


0x03:一处FTP

##########serv-u configs
ip=192.168.1.101
port=21
username=sopia
password=123


连接一处数据库作为测试:

1.png

修复方案:

安全不可忽视!希望正确面对网络安全问题。
更多隐患自己排查!

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-05-05 17:00

厂商回复:

CNVD未直接复现所述情况,已经由CNVD通过网站公开联系方式向网站管理单位通报。

最新状态:

暂无