当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-090414

漏洞标题:从一个上传到傲游内网

相关厂商:傲游

漏洞作者: Matt

提交时间:2015-01-07 09:32

修复时间:2015-01-12 09:34

公开时间:2015-01-12 09:34

漏洞类型:命令执行

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-07: 细节已通知厂商并且等待厂商处理中
2015-01-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

从一个上传到傲游内网

详细说明:

从一个上传到傲游内网

漏洞证明:

首先是发现一个子域名的上传
custom.maxthon.cn
在上传图标的时候只验证了content-type没有对文件后判断

1532ed2be1f9d7260dd9085f527ba9e0.png


简单改包拿到shell

d57e70ec59f41084d0c6864c438a71d1.png


发现一些配置信息

$_Database_Config = array('dbhost' => '10.0.8.48',
'dbuser' => 'm_backend_cn',
'dbpass' => 'aoOJ1beLIDApfJC',
'dbname' => 'adbrw_admin',
'charset' => 'utf8',
'pconnect' => '0',
'environments' => 'production'
'mail.maxthon.cn',
'port' => '25',
'auth' => 'true',
'user' => '[email protected]',
'pass' => '@2010'
/*$_Database_Config = array( 'dbhost' => 'localhost',
'dbuser' => 'root',
'dbpass' => '123456',
'dbname' => 'adbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
);*/
//?版.搴.??ワ?绾夸?
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'odbmac_admin',
'dbpass' => 'BvYinxtAiS9P05P',
'dbname' => 'odbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'odbmac_admin',
'dbpass' => 'BvYinxtAiS9P05P',
'dbname' => 'odbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
'dbuser' => 'm_mad_cn',
'dbpass' => 'zLXM5NoF107bS8l',
'dbname' => 'adbrw_mad',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_plugins_cn',
'dbpass' => 'MD2xPBtiyrf0z0Y',
'dbname' => 'adbrw_plugins',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_feedback_cn',
'dbpass' => 'Th8K6k7vw6g2eZy',
'dbname' => 'feedback',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'adbrw_project',
'dbpass' => '1q@W3e$R',
'dbname' => 'adbrw_channel',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_backendwp_cn',
'dbpass' => 'GrW651KCwDByFdH',
'dbname' => 'wp_admin',
'charset' => 'utf8',
'pconnect' => '0',
'environments' => 'development'
'dbuser' => 'm_webapp_cn',
'dbpass' => '63KlZYVG',
'dbname' => 'adbrw_webapp',
'charset' => 'utf8',
'pconnect' => '0'
smtp_main_send( array('[email protected]','[email protected]','[email protected]')
$mail->Host = "mail.maxthon.net";
$mail->Username = "[email protected]";
$mail->Password = "1qaz2wsx";


并且这个邮箱密码成功登录~

1.jpg


然后就提了个权

QQ图片20150107035621.png


root:$1$v4vAHK1L$p3MlF0AWUa3xMKMTBxG3f0:15733:0:99999:7:::
bin:*:15267:0:99999:7:::


随便扫了一下内网
zabbix

13a8794f4e4fee293f9d62146f620936.png


cacti

QQ图片20150107035643.png


QQ图片20150107035643.png


QQ图片20150107035743.png


QQ图片20150107035914.png


还有这个不知道是什么玩意

QQ图片20150107035749.png


254是个华为的路由 看登录界面总感觉就像是办宽带电信送的。。
恩。。没接触什么重要的东西,,点到为止,,差不多一点拿到的shell,到现在结束~

修复方案:

首先是发现一个子域名的上传
custom.maxthon.cn
在上传图标的时候只验证了content-type没有对文件后判断

1532ed2be1f9d7260dd9085f527ba9e0.png


简单改包拿到shell

d57e70ec59f41084d0c6864c438a71d1.png


发现一些配置信息

$_Database_Config = array('dbhost' => '10.0.8.48',
'dbuser' => 'm_backend_cn',
'dbpass' => 'aoOJ1beLIDApfJC',
'dbname' => 'adbrw_admin',
'charset' => 'utf8',
'pconnect' => '0',
'environments' => 'production'
'mail.maxthon.cn',
'port' => '25',
'auth' => 'true',
'user' => '[email protected]',
'pass' => '@2010'
/*$_Database_Config = array( 'dbhost' => 'localhost',
'dbuser' => 'root',
'dbpass' => '123456',
'dbname' => 'adbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
);*/
//?版.搴.??ワ?绾夸?
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'odbmac_admin',
'dbpass' => 'BvYinxtAiS9P05P',
'dbname' => 'odbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'odbmac_admin',
'dbpass' => 'BvYinxtAiS9P05P',
'dbname' => 'odbmac_admin',
'charset' => 'utf8',
'pconnect' => '0'
'dbuser' => 'm_mad_cn',
'dbpass' => 'zLXM5NoF107bS8l',
'dbname' => 'adbrw_mad',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_plugins_cn',
'dbpass' => 'MD2xPBtiyrf0z0Y',
'dbname' => 'adbrw_plugins',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_feedback_cn',
'dbpass' => 'Th8K6k7vw6g2eZy',
'dbname' => 'feedback',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'adbrw_project',
'dbpass' => '1q@W3e$R',
'dbname' => 'adbrw_channel',
'charset' => 'utf8',
'pconnect' => '0'
$_Database_Config = array( 'dbhost' => '10.0.8.48',
'dbuser' => 'm_backendwp_cn',
'dbpass' => 'GrW651KCwDByFdH',
'dbname' => 'wp_admin',
'charset' => 'utf8',
'pconnect' => '0',
'environments' => 'development'
'dbuser' => 'm_webapp_cn',
'dbpass' => '63KlZYVG',
'dbname' => 'adbrw_webapp',
'charset' => 'utf8',
'pconnect' => '0'
smtp_main_send( array('[email protected]','[email protected]','[email protected]')
$mail->Host = "mail.maxthon.net";
$mail->Username = "[email protected]";
$mail->Password = "1qaz2wsx";


并且这个邮箱密码成功登录~

1.jpg


然后就提了个权

QQ图片20150107035621.png


root:$1$v4vAHK1L$p3MlF0AWUa3xMKMTBxG3f0:15733:0:99999:7:::
bin:*:15267:0:99999:7:::


随便扫了一下内网
zabbix

13a8794f4e4fee293f9d62146f620936.png


cacti

QQ图片20150107035643.png


QQ图片20150107035643.png


QQ图片20150107035743.png


QQ图片20150107035914.png


还有这个不知道是什么玩意

QQ图片20150107035749.png


254是个华为的路由 看登录界面总感觉就像是办宽带电信送的。。
恩。。没接触什么重要的东西,,点到为止,,差不多一点拿到的shell,到现在结束~

版权声明:转载请注明来源 Matt@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-01-12 09:34

厂商回复:

最新状态:

暂无