当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0143988

漏洞标题:山西省晋中市某银行弱口令导致getshell大量信息泄漏

相关厂商:山西省晋中市某银行

漏洞作者: 路人甲

提交时间:2015-09-29 10:52

修复时间:2015-11-15 16:12

公开时间:2015-11-15 16:12

漏洞类型:后台弱口令

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-29: 细节已通知厂商并且等待厂商处理中
2015-10-01: cncert国家互联网应急中心暂未能联系到相关单位,细节仅向通报机构公开
2015-10-11: 细节向核心白帽子及相关领域专家公开
2015-10-21: 细节向普通白帽子公开
2015-10-31: 细节向实习白帽子公开
2015-11-15: 细节向公众公开

简要描述:

银行安全更需要重视

详细说明:

**.**.**.**:7001/SmartTeller/

3.jpg


问题出在中间件的弱口令
**.**.**.**:7001/console/login/LoginForm.jsp
weblogic/weblogic
通过上传war 拿到shell
**.**.**.**:7001/ma/ma3.jsp
这里存在着数据库的连接信息
/app/domains/teller/config/jdbc/teller-jdbc.xml

jdbc:oracle:thin:@**.**.**.**:1521:zqhf
teller
teller


大量数据库信息

TABLE_NAME
VARCHAR2
RB_CHEQUE_REG
DP_CNAPS_BANK
PRN_RECEIPT_DATA_OKI
PRN_DEVICE_TELLER
CL_GL_TABLE
FM_REF_CODE
TELLERLIMIT
ROLELIMIT
ORGLIMIT
PRN_RECEIPT_ORG_TMP
FM_CITY
PRN_RECEIPT_ORG
COUPON_REG
FM_DIST_CODE
TRAILBOXCASHBAK_20140504
DEL_201404014_ROLEAUTH
ROLEAUTH
RB_TRAN_DEF
FM_INDUSTRY
TXBASE
FM_GL_MAST_TBL
MENU
ROLEAUTHCURRENCY
FM_GL_MAST
RB_INT_MATRIX
FM_BASIS_RATE
DP_MSG_REJECT_TYPE
TXMODUAL
TXINFO
VOUCHERTRAILBOXLIMIT
FM_BASIS_RATE_20141122
RB_INT_MATRIX_20141122
DP2_TRAN_CATEGORY
DP2_TRAN_MAPPING
PRN_RECEIPT_TYPE
COUPON_REG_20150721
CASHTRAILVOUCHERMOVE
CASHTRAILBOXMOVE
DP2_RESPOND_CODE
DP2_TRAN_DEF
DP_TRAN_CATEGORY
FM_TAX_RATE
FM_INT_RATE
RB_PROD_CATEGORY
RB_PROD_BRANCH
DP_MSG_CODE
CL_ANALYSIS_1
RB_SERV_TYPE
DP2_MSG_CODE
RB_SERV_RATE
FM_INT_RATE_20141122
DP2_ELEMENT_CODE
FM_INT_TYPE
FM_BUSINESS
DP2_REJECT_TYPE
FM_SPECIAL_FINANCIAL
RB_PROD_NATURE
DP_MSG_BILL
RB_TRAN_SERV
RB_ACCT_TYPE
TELELROPERATIONCODE
ROLECONNECTION
RB_PROD_MULTI_DOC_TYPE
FM_CATEGORY_TYPE
FAKE_STOCK_TYPE
FM_ACCT_EXEC
FM_INT_BASIS
RB_PROD_DEFAULT
CL_CAR_CODE_TYPE
VOUCHERTYPE
CL_LOAN_SUB_TYPE
CL_LOAN_DEFAULT
RB_VOUCHER_DEF
CASHTRAILBOX
VOUCHERTRAILBOX
TELLER
TELLERSTATUS
FM_STATE
TELLERCCY
DP_REJECT_TYPE
FM_DEPT_ASSIGN
DP2_STATUS_DEF
RB_CASH_ITEM
CASHTRAILBOXLIMIT
DP_STATUS_DEF
CL_COLLATERAL_TYPE
RB_DEP_WTD_TRAN_TYPE
FM_INFO_TYPE
CL_PURPOSE
RB_ACCT_NATURE_DEF
FM_SP_RATE
MODULE
RB_RESTRAINT_TYPE
RB_CCY_DENOMINATION
FM_DOCUMENT_TYPE
FM_PERIOD_FREQ
FM_CLASS_4
PRN_DEVICE
FM_DEPARTMENT
PLFTXLOG
FM_CR_RATING
FM_CLASS_3
FM_MOODY_RATE
RB_CHEQUE_STATUS
BH_SYS_008_OPER_TYPE
FM_ECON_DIST
DP_BILL_CODE
DP2_MSG_TYPE
ROLEBASE
CL_CAR_CODE
FM_RELATION_TYPE
TELLERLEAVE
TELLERLEVEL
FM_EDUCATION
CL_REASON_CODE
RB_SUB_PROD_TYPE
FM_OCCUPATION
FM_CHANNEL
CONSTRAINTS_TMP
FM_CONTACT_TYPE
BH_PRINT_VOUCHER
FM_RESIDENT_TYPE
CL_REPAY_MODE
RECEIPT_IMPORT_BLANK
FM_BANK
FM_SETTLE_METHOD
FM_PL_FINANCIAL
FM_CLIENT_STATUS
CL_LOAN_TYPE
FM_TAX_TYPE
FM_REGION
FM_CESSATION_TYPE
DP2_BRANCH_MAP
DP2_SYSPARAM
FM_CCY_RATE
FM_BRANCH_CCY
FM_BRANCH_TBL
DP_MSG_PRIORITY
RB_GB_TYPE
RB_CHEQUE_TYPE
ORG
CL_ANALYSIS_2
FM_LOAN_GRADE
FM_PROFIT_CENTRE_TBL
CL_FEE_TYPE
ORGDATE
ORGCCY
FM_CLIENT_TYPE
ORGCHECKMODE
FM_MARKET_PARTICIPANT
FM_QUALIFICATION
FM_BORROWER_GRADE
RB_FACILITY_TRAN_DEF
TRANTYPE
TRAILBOXCASH_20140504
FM_CLIENT_ATTR_DEF
SECURITY_KEY_INFO
ORGLEVEL
FM_CLASS_5
RB_CLIENT_TYPE_GROUP
CL_ANALYSIS_3
TRAILBOXCASHBAK_20140423
ORGCHECKMODE_BAK20140328
TRAILBOXCASH_20130530
DEL_20140320_TRAILBOXCASH
RB_BATCH_ACCT_PRINT_INFO
CL_DOUBT_STATUS
DP_FORMAT_MSG_DEF
BH_SYS_001_CHANNEL_INFO
FM_COUNTER_PARTY
CL_STATUS
SECURITY_SYS_INFO
FM_SALUTATION
FM_LANGUAGE
RB_OVERDRAFT_TYPE
RB_BAL_TYPE_PRIORITY
DP_MSG_TYPE
ZONE
BH_BUSINESS_DEPARTMENT_REG
RB_SYSTEM
FM_CURRENCY
FT_TRAN_TYPE
RB_FIN_PARAM_DEF
FM_COMPANY
SEQUENCENO
FM_SYSTEM
FM_EXTERNAL_BRANCH
MOBILEDEVICEPARA
FM_CITY_DIST
SECURITY_NODE_INFO
CURRENCY
CL_SYSTEM
RB_DD_ARRANGE_DEF
FM_COUNTRY
RB_PROD_MULTI_CCY
RB_PROD_SERV_DEFAULT
RB_SERV_CARD_TYPE
RB_SESSION_PARAMETER
RB_SIGNATORY
RB_STMT_SERV_CHARGE
RB_TC_DENOMINATION
RB_TC_DENOM_GROUP
RT_CCY_DEF
RT_PRODUCT_TYPE
SCRID
SETOVERTIME
STATISTICSTYPE
TELLER_CASH_CODE
TELLER_FUND
TELLER_RESUME
TELLER_TARN_CODE
TRAILBOX
TXLIMIT
TXPROPERTY
WLSTORE
WL_WATCHLIST_TYPE
XY_CERTIFICATE_INFO
ATM027_TEMP
ATM027
PRN_RECEIPT_DATA_OKI_DYB
TEMPLETINFO
TOAD_PLAN_TABLE
GMT_BANK_CARD_BIN
FAKE_TURNIN_BOOK
FAKE_CCY_BOOK
TRAILBOXCASH
DAMAGED_CCY_BOOK
TRAILBOXVOUCHER
VOUCHERHISTORY
DP_CCY_DEF
CASHSIGN
RB_ACCT_TYPE_INVALD
HISTORYLOG
TELLERHISPWD
BUSINESSLOG
CASHEQUAL
VOUCHERSELECTTEMP
DP_BRANCH_MAP
CASHTRAILBOXMOVECASH
VOUCHEREQUAL
TRAILBOXCASHBAK
TELLERHOLIDAY
TRAILBOXVOUCHERTYPESUMBAK
TELLER_RB_BATCH
REPRN_RECEIPT_DATA
TRAILBOXVOUCHERTYPESUM
BTAUTHLOG
BTTXLOG
LOAN_NO_CONTRAST
AL_SYSTEM
BASEINFO
BH_BANKCODEINFO_102
BH_FEE_001_DATE
BH_FEE_002_TERM
BH_FEE_003_AMT
BH_FEE_004_FEE_TYPE
BH_FM_304_CYCLE
BH_NODECODEINFO_103
BH_PROJECT_STYLE
BH_TAXSUBJECTCODE_109
BH_TAXTYPECODE_108
BH_TP_PAYBANK_ORG
BH_TRAN_913_TRAN_EVENT
BH_TRECODEINFO_104
BILLCHECK
BRANCH_DICT
BRANCH_DICT_ITEM
CD_CARD_RULE
CD_CARD_SEQ_DEF
CD_CARD_TYPE_DEF
CD_PRODUCT_DEF
CL_BR_AGREEMENT_TBL
CL_COF_BASIS
CL_COF_BASIS_RATE
CL_DOCS
CL_FEE_BASIS
CL_FEE_DEFAULT
CL_PRE_RATE_TYPE
CRED_TYPE_TEMP
DP_EIS_BANK
DR_DEBT_ASSET
DR_LMT_INFO
ERRORCODE
EXCHANGERATE
EXCHANGERATELIMIT
FIN_TYPE_CODE
FM_BIC_DIRECTORY
FM_BP_CODE
FM_CLASS_1
FM_CLASS_2
FM_CLEAR_CODE
FM_FITCH
FM_FX_CODE
FREERATE
FT_CHARGE_TYPE
FT_PMTORD_DETAILS
FT_SWIFT_TAGS
GCASSUREMAIN
GL_ACCT
INTERESTRATE
ONWAYCASH
ORGLOGONRESTRICT
OTHERPARA
PARAMETERINFO
PARVALUE
PLSERVICE
PRN_RECEIPT_DATA
PRN_RECEIPT_FORMAT
RB_DISCOUNT_SERV_CHARGE
RB_EXCHANGE_TRAN_TYPE
RB_FLOAT_MATRIX
RB_INWD_TYPE
RB_MULTI_RVS_TRAN_TYPE


贴两张图

1.jpg


2.jpg


3.jpg

漏洞证明:

1.jpg


3.jpg

修复方案:

修改密码

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:13

确认时间:2015-10-01 16:10

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT向银行业信息化主管部门通报,由其后续协调网站管理单位处置. 同时发山西分中心处置。

最新状态:

暂无