当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0113314

漏洞标题:深航某站命令执行可深入内网

相关厂商:深圳航空

漏洞作者: fuckadmin

提交时间:2015-05-10 23:02

修复时间:2015-05-15 23:04

公开时间:2015-05-15 23:04

漏洞类型:命令执行

危害等级:高

自评Rank:13

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-10: 细节已通知厂商并且等待厂商处理中
2015-05-15: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

来两发深航。

详细说明:

1.深圳航空销售结算系统:http://119.147.23.66/
存在jboss invoker/JMXInvokerServlet 漏洞。
2.可以下载,证明漏洞存在:

1.jpg


3.已getshell,可深入内网

2.jpg


ifconfig

eth0      Link encap:Ethernet  HWaddr 00:22:19:7C:17:EE  
inet addr:10.11.101.12 Bcast:10.11.101.255 Mask:255.255.255.0
inet6 addr: fe80::222:19ff:fe7c:17ee/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3139641 errors:0 dropped:0 overruns:0 frame:0
TX packets:3168161 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:799244245 (762.2 MiB) TX bytes:1653100713 (1.5 GiB)
Interrupt:169 Memory:f8000000-f8012800
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:29392 errors:0 dropped:0 overruns:0 frame:0
TX packets:29392 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6302053 (6.0 MiB) TX bytes:6302053 (6.0 MiB)


/etc/hosts

# Do not remove the following line, or various programs
# that require network functionality will fail.
::1 localhost.localdomain localhost js-12
127.0.0.1 js-12 js-12
10.20.222.21 song
10.11.101.22 ssms_vip2
10.11.101.21 ssms_vip1
10.10.20.65 nbuserver


数据库配置信息

<?xml version="1.0" encoding="UTF-8"?>
<!-- ===================================================================== -->
<!-- -->
<!-- JBoss Server Configuration -->
<!-- -->
<!-- ===================================================================== -->
<!-- $Id: oracle-ds.xml 63175 2007-05-21 16:26:06Z rrajesh $ -->
<!-- ==================================================================== -->
<!-- Datasource config for Oracle originally from Steven Coy -->
<!-- ==================================================================== -->
<datasources>
<local-tx-datasource>
<jndi-name>jdbc/ssmsdb</jndi-name>
<connection-url>jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))</connection-url>
<!--
Here are a couple of the possible OCI configurations.
For more information, see http://otn.oracle.com/docs/products/oracle9i/doc_library/release2/java.920/a96654/toc.htm
jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))
<connection-url>jdbc:oracle:oci:@youroracle-tns-name</connection-url>
or
<connection-url>jdbc:oracle:oci:@(description=(address=(host=youroraclehost)(protocol=tcp)(port=1521))(connect_data=(SERVICE_NAME=yourservicename)))</connection-url>
Clearly, its better to have TNS set up properly.
-->
<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
<user-name>ssmsenter</user-name>
<password>jsxx09</password>
<min-pool-size>50</min-pool-size>
<max-pool-size>200</max-pool-size>
<!-- Uses the pingDatabase method to check a connection is still valid before handing it out from the pool -->
<!--valid-connection-checker-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleValidConnectionChecker</valid-connection-checker-class-name-->
<!-- Checks the Oracle error codes and messages for fatal errors -->
<exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleExceptionSorter</exception-sorter-class-name>
<!-- sql to call when connection is created
<new-connection-sql>some arbitrary sql</new-connection-sql>
-->
<!-- sql to call on an existing pooled connection when it is obtained from pool - the OracleValidConnectionChecker is prefered
<check-valid-connection-sql>some arbitrary sql</check-valid-connection-sql>
-->
<!-- corresponding type-mapping in the standardjbosscmp-jdbc.xml -->
<metadata>
<type-mapping>Oracle9i</type-mapping>
</metadata>
</local-tx-datasource>
</datasources>

漏洞证明:

1.深圳航空销售结算系统:http://119.147.23.66/
存在jboss invoker/JMXInvokerServlet 漏洞。
2.可以下载,证明漏洞存在:

1.jpg


3.已getshell,可深入内网

2.jpg


ifconfig

eth0      Link encap:Ethernet  HWaddr 00:22:19:7C:17:EE  
inet addr:10.11.101.12 Bcast:10.11.101.255 Mask:255.255.255.0
inet6 addr: fe80::222:19ff:fe7c:17ee/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3139641 errors:0 dropped:0 overruns:0 frame:0
TX packets:3168161 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:799244245 (762.2 MiB) TX bytes:1653100713 (1.5 GiB)
Interrupt:169 Memory:f8000000-f8012800
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:29392 errors:0 dropped:0 overruns:0 frame:0
TX packets:29392 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6302053 (6.0 MiB) TX bytes:6302053 (6.0 MiB)


/etc/hosts

# Do not remove the following line, or various programs
# that require network functionality will fail.
::1 localhost.localdomain localhost js-12
127.0.0.1 js-12 js-12
10.20.222.21 song
10.11.101.22 ssms_vip2
10.11.101.21 ssms_vip1
10.10.20.65 nbuserver


数据库配置信息

<?xml version="1.0" encoding="UTF-8"?>
<!-- ===================================================================== -->
<!-- -->
<!-- JBoss Server Configuration -->
<!-- -->
<!-- ===================================================================== -->
<!-- $Id: oracle-ds.xml 63175 2007-05-21 16:26:06Z rrajesh $ -->
<!-- ==================================================================== -->
<!-- Datasource config for Oracle originally from Steven Coy -->
<!-- ==================================================================== -->
<datasources>
<local-tx-datasource>
<jndi-name>jdbc/ssmsdb</jndi-name>
<connection-url>jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))</connection-url>
<!--
Here are a couple of the possible OCI configurations.
For more information, see http://otn.oracle.com/docs/products/oracle9i/doc_library/release2/java.920/a96654/toc.htm
jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(FAILOVER = ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip1) (PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ssms_vip2) (PORT=1521))(CONNECT_DATA=(SERVER = DEDICATED)(SERVICE_NAME=biz)(FAILOVER_MODE =(TYPE = SELECT)(METHOD = BASIC)(RETRIES = 30)(DELAY = 5))))
<connection-url>jdbc:oracle:oci:@youroracle-tns-name</connection-url>
or
<connection-url>jdbc:oracle:oci:@(description=(address=(host=youroraclehost)(protocol=tcp)(port=1521))(connect_data=(SERVICE_NAME=yourservicename)))</connection-url>
Clearly, its better to have TNS set up properly.
-->
<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
<user-name>ssmsenter</user-name>
<password>jsxx09</password>
<min-pool-size>50</min-pool-size>
<max-pool-size>200</max-pool-size>
<!-- Uses the pingDatabase method to check a connection is still valid before handing it out from the pool -->
<!--valid-connection-checker-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleValidConnectionChecker</valid-connection-checker-class-name-->
<!-- Checks the Oracle error codes and messages for fatal errors -->
<exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleExceptionSorter</exception-sorter-class-name>
<!-- sql to call when connection is created
<new-connection-sql>some arbitrary sql</new-connection-sql>
-->
<!-- sql to call on an existing pooled connection when it is obtained from pool - the OracleValidConnectionChecker is prefered
<check-valid-connection-sql>some arbitrary sql</check-valid-connection-sql>
-->
<!-- corresponding type-mapping in the standardjbosscmp-jdbc.xml -->
<metadata>
<type-mapping>Oracle9i</type-mapping>
</metadata>
</local-tx-datasource>
</datasources>

修复方案:

你们更专业

版权声明:转载请注明来源 fuckadmin@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-05-15 23:04

厂商回复:

漏洞Rank:15 (WooYun评价)

最新状态:

暂无